lotl

LotL RMM

GitHub-native command-and-control framework for authorized security research, with encrypted multi-channel transport and resilient failover.

Living Off The Land (LOTL) persistent Reverse shell

SysWhispers & HellsGate successor, executing protected Indirect & Direct syscalls in EDR protected settings

BypassIT is a framework for covert malware delivery and post-exploitation using AutoIT for red / blue team self assessment.

Best practice configuration for Linux auditd for CIS and STIG standards, enhanced with LOTL detection rules. If you need help with implementation, contact@criticalmissions.be

Advanced Living Off the Land (LotL) tactics, tools, and abuse techniques for red teams, defenders, and cyber researchers. Stealth over payload.

A kotlin library for verifying certificate chains using trusted lists

LotL-Watcher is a lightweight security monitoring tool designed to detect and mitigate "Living-off-the-Land" attacks. Instead of relying on traditional file signatures, this tool monitors the behavior of trusted Windows binaries (like certutil, powershell, wmic, mshta).

Zero-file, LotL command for memory-resident binary execution. Bypasses EDR vectors by leveraging memfd_create and os.execve to pivot from an obfuscated Base85/Bit-Shift one-liner to a fileless process execution masquerading as a kernel thread without disk footprints.

A Purple Team simulation framework demonstrating Windows persistence mechanisms, evasion, and behavioral EDR detection

Detection engineering lab: simulating a Living off the Land (LotL) attack (vssadmin shadow copy deletion) on a Windows Server 2022 EC2 instance, capturing it with Sysmon, and building a validated Splunk SPL detection rule. Maps to MITRE ATT&CK T1490 & T1218.

Endpoint investigation of a PowerShell LotL attack reconstructing persistence via Windows services, extracting IOCs, and mapping to MITRE ATT&CK using Kibana and Windows event logs.

POC framework for detecting LOLBin abuse in Sysmon logs using Splunk SPL. Implements 12 layered checks (signature matching, parent-child anomalies, threat intel, statistical baselines) with risk scoring for automated alert prioritization. Supports standalone Splunk or distributed n8n architecture.

Worshop en Red Team Space, Ekoparty 2023

Sanitized DFIR case study of a fake CAPTCHA malware delivery chain involving mshta, obfuscated PowerShell, LOTL behavior, IOC analysis, and remediation actions.

Source code for a deprecated "LOTL file transfer technique" which would utilize the Windows BITS subsystem

Trust Registry: EU LOTL and national Trusted Lists (ETSI TS 119 612) aggregated with the private List of Trusted Entities (ETSI TS 119 602), published as a signed snapshot

LOTL network scanner in pure Bash — host discovery, port scan, banner grabbing, no external tools

CLI tool for converting Markdown to PDF with customizable themes. Simple, fast, and a little bit cute.