---
title: "LOLBins: How cyber attackers bypass traditional security defenses"
description: Learn one method used by attackers to gain a foothold in a network and escalate their privileges.
image: https://blog.teamascend.com/hubfs/Blog%20Feature%20Images/100919_CyberattackSeries-02.jpg
---
[Skip to main content](https://blog.teamascend.com/blog/lolbins#main)
[ ](https://teamascend.com/)
- [Show submenu for Services Services](http://teamascend.com/services/)
- [Show submenu for IT Consulting IT Consulting](https://teamascend.com/services/strategic-consulting/)
- [Healthcare Consulting](https://teamascend.com/services/healthcare/)
- [Show submenu for Cybersecurity Cybersecurity](https://teamascend.com/services/cybersecurity/)
- [Ascend Defend | Microsoft Security](https://teamascend.com/services/microsoft-365/microsoft-security-ascend-defend/)
- [Managed Detection & Response](https://teamascend.com/services/cybersecurity/managed-detection-response/)
- [Identity Protection & MFA](https://teamascend.com/services/cybersecurity/identity-protection-mfa/)
- [Email Security](https://teamascend.com/services/cybersecurity/email-security/)
- [Perimeter Security](https://teamascend.com/services/cybersecurity/perimeter-security-ngfw/)
- [vCISO](https://teamascend.com/services/cybersecurity/vciso/)
- [Security Risk Assessment](https://teamascend.com/services/it-assessments/security-risk-assessment/)
- [Penetration Testing](https://teamascend.com/services/infrastructure/penetration-testing/)
- [Vulnerability Management](https://teamascend.com/services/cybersecurity/vulnerability-management-program/)
- [Security Awareness Training](https://teamascend.com/services/cybersecurity/security-awareness-program/)
- [Show submenu for IT Infrastructure IT Infrastructure](https://teamascend.com/services/infrastructure/)
- [24/7 Support Desk](https://teamascend.com/services/infrastructure/support-desk/)
- [VCIO](https://teamascend.com/services/infrastructure/vcio/)
- [Managed Infrastructure](https://teamascend.com/services/infrastructure/managed-infrastructure-services/)
- [Data Protection (BaaS)](https://teamascend.com/services/infrastructure/data-protection/)
- [Onsite Rounding](https://teamascend.com/services/infrastructure/onsite-rounding/)
- [Application Administration Services](https://teamascend.com/services/infrastructure/application-administration/)
- [IT Infrastructure Assessment](https://teamascend.com/services/it-assessments/infrastructure-assessment/)
- [Product](https://teamascend.com/services/infrastructure/product/)
- [Show submenu for Cloud Cloud](https://teamascend.com/services/cloud-computing/)
- [Ascend Cloud | Managed Private Data Center](https://teamascend.com/services/cloud-computing/edafio-cloud/)
- [Hybrid Cloud](https://teamascend.com/services/cloud-computing/hybrid-cloud-solutions/)
- [Cloud Security (CSPM)](https://teamascend.com/services/cloud-computing/cloud-security-posture-management/)
- [Cloud Assessment](https://teamascend.com/services/cloud-computing/cloud-assessment/)
- [Digitial Workspace Deployment](https://teamascend.com/services/cloud-computing/digital-workspace-deployment/)
- [Cloud Migration](https://teamascend.com/services/cloud-computing/cloud-migration/)
- [Show submenu for Microsoft Services Microsoft Services](https://teamascend.com/services/microsoft-365/)
- [Ascend Defend | Microsoft Security](https://teamascend.com/services/microsoft-365/microsoft-security-ascend-defend/)
- [Microsoft 365 Copilot](https://teamascend.com/services/microsoft-365/microsoft-365-copilot/)
- [Microsoft Licensing](https://teamascend.com/services/microsoft-365/microsoft-licensing/)
- [Microsoft 365 Management](https://teamascend.com/services/microsoft-365/microsoft-365-management/)
- [Microsoft 365 Migration](https://teamascend.com/services/microsoft-365/)
- [Show submenu for Salesforce Salesforce](https://teamascend.com/salesforce-services/)
- [Consulting Services](https://teamascend.com/salesforce-services/salesforce-consulting-services/)
- [Implementation Services](https://teamascend.com/salesforce-services/salesforce-implementation-services/)
- [Managed Services](https://teamascend.com/salesforce-services/salesforce-managed-services/)
- [Embedded Experts](https://teamascend.com/salesforce-services/salesforce-embedded-experts/)
- [Optimization Assessment](https://teamascend.com/salesforce-services/salesforce-optimization-assessment/)
- [Salesforce AppExchange](https://teamascend.com/salesforce-services/salesforce-appexchange/)
- [HubSpot Services](https://teamascend.com/services/hubspot-services/)
- [App Development](https://teamascend.com/services/application-development/)
- [Show submenu for Industries Industries](https://teamascend.com/industries/)
- [Financial Services](https://teamascend.com/industries/financial-services/)
- [Private Equity](https://teamascend.com/industries/private-equity/)
- [Insurance](https://teamascend.com/industries/insurance/)
- [Manufacturing](https://teamascend.com/industries/manufacturing/)
- [Healthcare](https://teamascend.com/industries/healthcare/)
- [Legal](https://teamascend.com/industries/legal/)
- [Accounting](https://teamascend.com/industries/accounting/)
- [Show submenu for Resources Resources](https://teamascend.com/resources/)
- [Client Success Stories](https://teamascend.com/client-success-stories/)
- [Events](https://teamascend.com/events/)
- [Solutions-Focused PDFs](https://teamascend.com/resources/#solutions)
- [Blog](https://blog.teamascend.com/)
- [Webinars](https://teamascend.com/resources/?_resource_type=webinar)
- [All Resources](https://teamascend.com/resources/)
- Show submenu for Company Company
- [About Ascend Technologies](https://teamascend.com/about/)
- [Leadership Team](https://teamascend.com/about/team/)
- [Partners With Us](https://teamascend.com/about/partner-with-us/)
- [Awards & Recognitions](https://teamascend.com/about/awards/)
- [Certifications](https://teamascend.com/about/certifications/)
- [Careers](https://teamascend.com/careers/)
- [Internships](https://teamascend.com/careers/internships/)
- [Connect](https://teamascend.com/contact/)
Open main navigation
Close main navigation
- Show submenu for Services Services
- Services
- [Services](http://teamascend.com/services/)
- Show submenu for IT Consulting IT Consulting
- IT Consulting
- [IT Consulting](https://teamascend.com/services/strategic-consulting/)
- [Healthcare Consulting](https://teamascend.com/services/healthcare/)
- Show submenu for Cybersecurity Cybersecurity
- Cybersecurity
- [Cybersecurity](https://teamascend.com/services/cybersecurity/)
- [Ascend Defend | Microsoft Security](https://teamascend.com/services/microsoft-365/microsoft-security-ascend-defend/)
- [Managed Detection & Response](https://teamascend.com/services/cybersecurity/managed-detection-response/)
- [Identity Protection & MFA](https://teamascend.com/services/cybersecurity/identity-protection-mfa/)
- [Email Security](https://teamascend.com/services/cybersecurity/email-security/)
- [Perimeter Security](https://teamascend.com/services/cybersecurity/perimeter-security-ngfw/)
- [vCISO](https://teamascend.com/services/cybersecurity/vciso/)
- [Security Risk Assessment](https://teamascend.com/services/it-assessments/security-risk-assessment/)
- [Penetration Testing](https://teamascend.com/services/infrastructure/penetration-testing/)
- [Vulnerability Management](https://teamascend.com/services/cybersecurity/vulnerability-management-program/)
- [Security Awareness Training](https://teamascend.com/services/cybersecurity/security-awareness-program/)
- Show submenu for IT Infrastructure IT Infrastructure
- IT Infrastructure
- [IT Infrastructure](https://teamascend.com/services/infrastructure/)
- [24/7 Support Desk](https://teamascend.com/services/infrastructure/support-desk/)
- [VCIO](https://teamascend.com/services/infrastructure/vcio/)
- [Managed Infrastructure](https://teamascend.com/services/infrastructure/managed-infrastructure-services/)
- [Data Protection (BaaS)](https://teamascend.com/services/infrastructure/data-protection/)
- [Onsite Rounding](https://teamascend.com/services/infrastructure/onsite-rounding/)
- [Application Administration Services](https://teamascend.com/services/infrastructure/application-administration/)
- [IT Infrastructure Assessment](https://teamascend.com/services/it-assessments/infrastructure-assessment/)
- [Product](https://teamascend.com/services/infrastructure/product/)
- Show submenu for Cloud Cloud
- Cloud
- [Cloud](https://teamascend.com/services/cloud-computing/)
- [Ascend Cloud | Managed Private Data Center](https://teamascend.com/services/cloud-computing/edafio-cloud/)
- [Hybrid Cloud](https://teamascend.com/services/cloud-computing/hybrid-cloud-solutions/)
- [Cloud Security (CSPM)](https://teamascend.com/services/cloud-computing/cloud-security-posture-management/)
- [Cloud Assessment](https://teamascend.com/services/cloud-computing/cloud-assessment/)
- [Digitial Workspace Deployment](https://teamascend.com/services/cloud-computing/digital-workspace-deployment/)
- [Cloud Migration](https://teamascend.com/services/cloud-computing/cloud-migration/)
- Show submenu for Microsoft Services Microsoft Services
- Microsoft Services
- [Microsoft Services](https://teamascend.com/services/microsoft-365/)
- [Ascend Defend | Microsoft Security](https://teamascend.com/services/microsoft-365/microsoft-security-ascend-defend/)
- [Microsoft 365 Copilot](https://teamascend.com/services/microsoft-365/microsoft-365-copilot/)
- [Microsoft Licensing](https://teamascend.com/services/microsoft-365/microsoft-licensing/)
- [Microsoft 365 Management](https://teamascend.com/services/microsoft-365/microsoft-365-management/)
- [Microsoft 365 Migration](https://teamascend.com/services/microsoft-365/)
- Show submenu for Salesforce Salesforce
- Salesforce
- [Salesforce](https://teamascend.com/salesforce-services/)
- [Consulting Services](https://teamascend.com/salesforce-services/salesforce-consulting-services/)
- [Implementation Services](https://teamascend.com/salesforce-services/salesforce-implementation-services/)
- [Managed Services](https://teamascend.com/salesforce-services/salesforce-managed-services/)
- [Embedded Experts](https://teamascend.com/salesforce-services/salesforce-embedded-experts/)
- [Optimization Assessment](https://teamascend.com/salesforce-services/salesforce-optimization-assessment/)
- [Salesforce AppExchange](https://teamascend.com/salesforce-services/salesforce-appexchange/)
- [HubSpot Services](https://teamascend.com/services/hubspot-services/)
- [App Development](https://teamascend.com/services/application-development/)
- Show submenu for Industries Industries
- Industries
- [Industries](https://teamascend.com/industries/)
- [Financial Services](https://teamascend.com/industries/financial-services/)
- [Private Equity](https://teamascend.com/industries/private-equity/)
- [Insurance](https://teamascend.com/industries/insurance/)
- [Manufacturing](https://teamascend.com/industries/manufacturing/)
- [Healthcare](https://teamascend.com/industries/healthcare/)
- [Legal](https://teamascend.com/industries/legal/)
- [Accounting](https://teamascend.com/industries/accounting/)
- Show submenu for Resources Resources
- Resources
- [Resources](https://teamascend.com/resources/)
- [Client Success Stories](https://teamascend.com/client-success-stories/)
- [Events](https://teamascend.com/events/)
- [Solutions-Focused PDFs](https://teamascend.com/resources/#solutions)
- [Blog](https://blog.teamascend.com/)
- [Webinars](https://teamascend.com/resources/?_resource_type=webinar)
- [All Resources](https://teamascend.com/resources/)
- Show submenu for Company Company
- Company
- [About Ascend Technologies](https://teamascend.com/about/)
- [Leadership Team](https://teamascend.com/about/team/)
- [Partners With Us](https://teamascend.com/about/partner-with-us/)
- [Awards & Recognitions](https://teamascend.com/about/awards/)
- [Certifications](https://teamascend.com/about/certifications/)
- [Careers](https://teamascend.com/careers/)
- [Internships](https://teamascend.com/careers/internships/)
- [Connect](https://teamascend.com/contact/)
- [24/7 Client Services](https://portal-ascend.okta.com/)
[24/7 Client Services](https://portal-ascend.okta.com/)
Endpoint Detection & Response (EDR), Detection & Response
# LOLBins: How cyber attackers bypass traditional security defenses
TEAM ASCEND
October 8, 2019
- [.svg)](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fblog.teamascend.com%2Fblog%2Flolbins)
- [.svg)](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fblog.teamascend.com%2Fblog%2Flolbins)
- [](mailto:?subject=%3Cspan+id%3D%22hs_cos_wrapper_name%22+class%3D%22hs_cos_wrapper+hs_cos_wrapper_meta_field+hs_cos_wrapper_type_text%22+style%3D%22%22+data-hs-cos-general-type%3D%22meta_field%22+data-hs-cos-type%3D%22text%22+%3ELOLBins%3A+How+cyber+attackers+bypass+traditional+security+defenses%3C%2Fspan%3E&body=https%3A%2F%2Fblog.teamascend.com%2Fblog%2Flolbins)
*Learn one method used by attackers to gain a foothold in a network and escalate their privileges.*
One of the more common perceptions of cyberattacks is that “getting hacked” usually involves malicious software or files. The truth is, cyber attackers can easily gain traction in an attack without using any malicious software at all. One of the ways they can do this is by using your computer against itself.
Enter defense evasion and privilege escalation—namely *LOLBins* and *User Account Control (UAC)*. Attackers’ goals—once they have initiated an attack—are mainly to avoid being stopped by existing security defenses and to escalate their user privileges. Escalating privileges within a network is key for attackers' progress, allowing them to do more, access more, and, to put it simply, cause more damage.
### **LOLBins – what are they?**
[LOLBins](https://lolbas-project.github.io/)—Living Off the Land Binaries—are non-malicious [binaries](https://www.computerhope.com/jargon/b/binaries.htm)that cyber criminals have discovered can be used to hide their malicious activity within a system and evade cyber defenses. The idea behind the LOLBin technique is that attackers can find legitimate, benign, and usually built-in executables present within an operating system, and then use those binaries to achieve malicious goals *without* relying on malicious code or files.
Using LOLBins, attackers can “live off the land”—as the name suggests—and use a machine’s resources against itself to progress their attack.
LOLBins are Microsoft-signed files, meaning they are either native to the Operating System (OS) and come pre-installed, or are available from Microsoft (i.e. a Microsoft program or add-on). Despite being legitimate (and well-intentioned) files, these binaries can be exploited by an attacker and used in an attack.
LOLBins can provide a range of features and abilities to the savvy cyber criminals who discover them—ranging from executing code, to performing file operations (downloading, uploading, copying, etc.), to stealing passwords.
One common LOLBin is[Regsvr32.exe](https://attack.mitre.org/techniques/T1117/), sometimes called the[Squiblydoo](https://www.theregister.co.uk/2016/04/29/squiblydoo/) attack. “Regsvr32” is a standard utility that aids in registering and unregistering system controls. To put it simply, it’s a function used primarily by advanced users to complete computing tasks like [adding programs to the Windows Registry](https://www.lifewire.com/regsvr32-what-it-is-how-to-register-dlls-2623958). While the everyday computer user or device owner is not likely to manually run this command in their day-to-day computing, Regsvr32.exe is still a fundamental binary and a built-in function on Windows devices.
Because Regsvr32 is present on every windows machine and has inherent code-running capabilities, cyber criminals like to use it to bypass a computer’s existing [Application Whitelisting](https://digitalguardian.com/blog/what-application-whitelisting-application-whitelisting-definition) and execute code that would otherwise be blocked from running. With this ability, attackers can bypass existing security defenses (such as Application Whitelisting and User Account Control) and then run other variations of code to escalate their privileges on the machine.
### **Why attackers want to bypass User Account Control (UAC)**
[User Account Control (UAC)](https://docs.microsoft.com/en-us/windows/security/identity-protection/user-account-control/how-user-account-control-works) is another built-in security feature of Windows devices that acts as a roadblock to cyber attackers. UAC helps separate the capabilities of an administrative user from those of a standard, non-admin user.
Have you ever tried to install, open, or change a program and been faced with this popup box?
That’s UAC in action. These credential prompt boxes keep standard users from being able to make changes to their system that could impact their security or otherwise put their device at risk, leaving the responsibility to IT or security admins to make the right call.
It can be frustrating when you’re trying to install an application on your work laptop, but that means it’s doing its job. Having UAC in place helps prevent attackers from installing programs or running code that requires administrative-level permissions.
With the help of LOLBins, however, attackers can sneakily [bypass UAC](https://attack.mitre.org/techniques/T1088/)and escalate their user privileges without having access to administrative credentials. With “stolen” admin capabilities, an attacker can run programs or malicious code, use programs to steal legitimate credentials, and more.
### **The attack in action**
In the short video below, Infogressive Engineer Will demonstrates the use of regsvr32.exe to evade Application Whitelisting and then the UAC bypass tactic in action, as well as some of the ways to prevent and detect this type of cyberattack.
### **Cybersecurity Game Plan**
###### *Offense*
If an attacker was present on your network and and using LOLBins to bypass security, strong detection solutions have your back.
With a combination of [Endpoint Detection & Response (EDR)](https://www.infogressive.com/managed-security/mdr/edr/) and expert [Log Analysis](https://www.infogressive.com/managed-security/mdr/log-analysis/), signs of an attack would be detected and alerted upon immediately.
EDR actively tracks and analyzes user behavior on computers—it knows what’s “normal” and what’s out of the ordinary. When an attacker bypasses security or runs a program that a regular user wouldn’t be accessing, that creates an alert for security analysts to investigate and identify the ongoing attack.
Adding EDR’s capabilities to traditional SIEM monitoring and alerting, backed by a 24x7 Security Operations Center (SOC) allows you to rest assured that even the sneakiest attack tactics can be identified and stopped before the damage is done.
###### *Defense*
Prevention is still possible for this type of attack—there are multiple areas where an attacker could be stopped before reaching their end goal, and layered cybersecurity is an effective way to cover those bases.
Starting with an effective [malware prevention solution](https://www.infogressive.com/managed-security/endpoint-security/malware-prevention/), you can stop an attacker in their tracks. If your AV can detect and block attacks running in memory, then an attacker would be out of luck trying to use a LOLBin like Regsvr32.exe to bypass your security.
But why wait until the attacker is already in your network? With a combination of a Next-Generation Firewall [configured to secure “open doors”](https://www.infogressive.com/managed-security/perimeter-security/) and exploitable vulnerabilities,[strong email security](https://www.infogressive.com/managed-security/email-security/)to block attacks entering via phishing or spam, and[well-trained users](https://www.infogressive.com/managed-security/email-security/phishing-security-awareness/) who know how to identify cybersecurity risks, you can prevent the attacker from getting on the computer in the first place.
Tune in to our [Cyberattack Series](https://content.infogressive.com/cyberattack-series) to learn more about the top attacks you face in today’s threat landscape and some of the techniques used by your cyber adversaries.
[](https://cta-redirect.hubspot.com/cta/redirect/2733374/d534b9a3-49dd-43ed-bea1-15a16ab3565e)
### Table of Contents
#### Get Insights Sent to Your Inbox
## Related Articles
Endpoint Detection & Response (EDR), Detection & Response
### [How to Build an AI Governance Framework a Lean IT Team Can Run](https://blog.teamascend.com/blog/ai-governance-framework-for-lean-it-teams-ascend)
September 24, 2026
[Read Now .svg)](https://blog.teamascend.com/blog/ai-governance-framework-for-lean-it-teams-ascend)
Endpoint Detection & Response (EDR), Detection & Response
### [How to Choose the Right Salesforce Products for Your Business](https://blog.teamascend.com/blog/how-to-choose-the-right-salesforce-products-for-your-business)
September 22, 2026
[Read Now .svg)](https://blog.teamascend.com/blog/how-to-choose-the-right-salesforce-products-for-your-business)
Endpoint Detection & Response (EDR), Detection & Response
### [What Is Shadow AI, and Why Is It a Compliance Risk Right Now?](https://blog.teamascend.com/blog/shadow-ai-compliance-risk-regulated-industries)
September 17, 2026
[Read Now .svg)](https://blog.teamascend.com/blog/shadow-ai-compliance-risk-regulated-industries)
[](https://teamascend.com/)
Contact
833-639-2285
-
-
-
-
-
- Company
- [About](https://teamascend.com/about/)
- [Services](https://teamascend.com/services/)
- [Testimonials](https://teamascend.com/client-success-stories/)
- [Partner With Us](https://teamascend.com/about/partner-with-us/)
- [Resources](https://teamascend.com/resources/)
- [Contact](https://teamascend.com/contact/)
- [Careers](https://teamascend.com/careers/)
- Services
- [IT Consulting](https://teamascend.com/services/strategic-consulting/)
- [Cybersecurity](https://teamascend.com/services/cybersecurity/)
- [IT Infrastructure](https://teamascend.com/services/infrastructure/)
- [Cloud](https://teamascend.com/services/cloud-computing/)
- [24/7 Support Desk](https://teamascend.com/services/infrastructure/support-desk/)
- [Microsoft Services](https://teamascend.com/services/microsoft-365/)
- [Salesforce Services](https://teamascend.com/salesforce-services/)
- [HubSpot Services](https://teamascend.com/services/hubspot-services/)
- [App Development](https://teamascend.com/services/application-development/)
### Empowering Technology. Powered by People.
Technology is critical to businesses across all industries. Today's technology must be smart, reliable, adaptable, and secure. At Ascend Technologies, we deliver solutions at the highest level, from cloud computing to proactive cybersecurity strategies to Salesforce excellence. And the team? As impressive as the tech. Our practical support is focused on one thing: your success. Let's see what we can do together.
[Contact Us](https://teamascend.com/contact/)
©2026 Ascend Technologies, LLC, All Rights Reserved | [Privacy Policy](https://teamascend.com/privacy-policy/)
```json
{
"@context" : "https://schema.org",
"@type" : "WebPage",
"breadcrumb" : {
"@type" : "BreadcrumbList",
"itemListElement" : [ {
"@type" : "ListItem",
"item" : "https://blog.teamascend.com",
"name" : "Home",
"position" : 1
} ]
},
"dateModified" : "2023-10-20T14🇲🇲00",
"description" : "Learn one method used by attackers to gain a foothold in a network and escalate their privileges.",
"name" : "LOLBins: How cyber attackers bypass traditional security defenses",
"primaryImageOfPage" : {
"@type" : "ImageObject",
"url" : "https://content.teamascend.com/hubfs/Blog%20Feature%20Images/100919_CyberattackSeries-02.jpg"
},
"publisher" : {
"@type" : "Organization",
"logo" : {
"@type" : "ImageObject",
"url" : "https://content.teamascend.com/hubfs/Ascend-Technologies-HubSpot-Logo.png"
},
"name" : "Ascend Technologies",
"url" : "https://blog.teamascend.com"
},
"url" : "https://blog.teamascend.com/blog/lolbins"
}
```