In security practice, what are LOLbins commonly used for?

• A. Exfiltration via external payloads
• B. Generating random data
• C. Exploiting legitimate system binaries to move laterally while remaining stealthy
• D. Logging user activity

Answer: (C)

LOLbins are living-off-the-land binaries—legitimate system tools that attackers abuse to perform actions without introducing new, suspicious software. The strength of using these trusted binaries is that they already exist on the host, are often signed, and blend in with normal activity, making malicious actions harder to spot. In practice, this means attackers leverage these binaries to execute commands, move laterally across systems, and carry out tasks while staying stealthy, rather than dropping external payloads or bringing in new executables. That’s why using legitimate system binaries to move laterally while remaining stealthy is the best description.