The simplest way to get past an endpoint detection tool is often not to bring your own malicious binary at all. Living-off-the-land binaries (LOLBins) are legitimate, trusted executables already present on the operating system that an attacker can repurpose to run code, move files, or persist - PowerShell, certutil, mshta, rundll32 and regsvr32 on Windows; curl, wget and python on Linux, among many others.

[INFO]
This article summarises the publicly maintained LOLBAS project and secondary coverage of it. An earlier version of this article claimed a specific 2026 case count drawn from this site's own incident response data and malformed JARM fingerprints as evidence; neither exists, and both have been removed.

//Why It Works Against EDR

Endpoint detection and response tools are generally strongest at flagging unfamiliar or suspicious binaries and unusual process behaviour. A LOLBin attack routes around that strength by using a binary the system already trusts, signed by the operating system vendor, doing something the tool was in fact designed to do - PowerShell running a script, certutil decoding a file, rundll32 loading a DLL. The defensive challenge shifts from "is this file malicious" to "is this otherwise-normal action happening in a context that should raise suspicion," which is a harder question to answer automatically.

The LOLBAS project (lolbas-project.github.io) catalogues this family of techniques publicly, organised by binary, with the specific command-line patterns each one enables. A related project, LOLDrivers, catalogues legitimately signed Windows drivers that can be abused for kernel-level access - the BYOVD (bring your own vulnerable driver) technique that lets an attacker load a vulnerable but validly signed driver purely to exploit a flaw in it.

What defenders are advised to watch for

Because the binaries themselves are legitimate, detection guidance generally centres on context rather than identity: unusual parent-child process relationships (a document viewer spawning PowerShell, for instance), command-line arguments that don't match how a binary is normally invoked, and the binary running from or acting on an unexpected location. MITRE ATT&CK documents LOLBin-style techniques across several of its tactics, and MITRE-aligned mitigations commonly cited include application allow-listing tools such as AppLocker and tighter permission controls on which accounts can invoke the more dangerous binaries.

//What This Rewrite Could Not Confirm

The withdrawn version of this article framed LOLBin chaining and "sleep masking" as the dominant 2026 incident-response trend, displacing BYOVD, and cited a specific case count to support that claim. This rewrite found no public reporting establishing that shift as a documented trend for 2026, and the case count had no traceable source. The general technique - LOLBAS and LOLDrivers as real, actively maintained resources - is accurately described above; the trend claim is not repeated here because it could not be verified.

[WARNING]
For current, vendor-specific EDR evasion trends, check a named vendor's incident response reporting (for example an annual threat report that states its own case count and methodology) rather than this page.