Black Hat Webinar: The LOLBAS Odyssey

This session examines how attackers abuse legitimate Windows binaries and scripts (LOLBAS) to evade detection and operate under the radar. It focuses specifically on how attackers download payloads and execute malicious code using trusted executables that are already present in enterprise environments. The webinar demonstrates a research methodology that evolved from manual testing of Office binaries into automation-driven dynamic analysis capable of scaling across thousands of executables.

The presentation explains how to instrument monitoring to identify download behavior and analyze process parent-child relationships to detect suspicious execution patterns. It also discusses future research directions, including static analysis automation and AI-assisted techniques to identify dangerous API calls. The session concludes with defender-focused recommendations for detecting and disrupting LOLBAS-driven attacks.