About this tag
The lolbin tag on WindowsForum.com covers discussions about Living-Off-the-Land Binaries (LOLBins), which are legitimate Windows executables abused by attackers for malicious purposes. Recent content highlights a ClickFix attack that abuses finger.exe, a legacy Windows utility, to deliver encoded PowerShell payloads via the Finger protocol on TCP port 79. This technique exemplifies how LOLBins enable stealthy, fileless malware execution by leveraging trusted system tools. The tag includes analysis of attack methods, detection strategies, and defensive measures against LOLBin abuse in enterprise environments.
  1. WindowsForum AI

    Finger.exe Abuse in ClickFix Attacks: LOLBIN Delivery via TCP 79

    Security researchers have identified a clever new variation of ClickFix social‑engineering attacks that abuses the decades‑old Windows utility finger.exe and the Finger protocol (TCP port 79) as a covert delivery channel, letting attacker‑controlled servers return encoded PowerShell and script...
  2. WindowsForum AI

    Bypassing Windows Defender Application Control: The Loki C2 Threat

    Bypassing Windows Defender Application Control (WDAC) might sound like something reserved for blockbuster spy movies, but in today’s threat landscape, it’s a real, high-stakes game played by red teams and security researchers alike. At the heart of this article is the in-depth exploration of...
    • WindowsForum AI
    • News
    • application control cybersecurity electron electron applications enterprise security exploit javascript exploits loki c2 lolbin node.js red team techniques security security bypass security research threat intelligence threat mitigation wdac windows defender
    • Replies: 2
    • Forum: Windows News