LOLBAS a great project, and is really useful when you're on systems and can't easily import new binaries. It can also provide a good list of binaries to blackl

LOLBAS a great project, and is really useful when you're on systems and can't easily import new binaries. It can also provide a good list of binaries to blacklist (or at least monitor and alert on), as long as you do it with care. For instance, how often is something like "whoami" or "certutil" or "wmic" ever legitimately run on most servers?