+ Document every Microsoft-signed binary, script, and library that can be
+ used for living off the land techniques. Legitimate tools can execute
+ code, transfer files, bypass application allowlisting, access credentials,
+ and perform other actions beyond their expected use.
+
+
What belongs in LOLBAS?
+
+
+ A Microsoft-signed file, native to Windows or available from Microsoft.
+
+
+ Unexpected functionality, with an exception for application allowlisting
+ bypasses.
+
+
+ Functionality useful in adversary simulation or to an advanced threat
+ actor.
+
+ The phrase “living off the land” was coined by Christopher Campbell and
+ Matt Graeber at DerbyCon 3. LOLBAS grew from community research into a
+ shared catalog maintained by volunteers.
+
+
The original project logos were created by Adam Nadrowski.
+
+
diff --git a/website/src/pages/api.astro b/website/src/pages/api.astro
new file mode 100644
index 000000000..e6e8231f2
--- /dev/null
+++ b/website/src/pages/api.astro
@@ -0,0 +1,109 @@
+---
+import { sitePath } from '../lib/site';
+import Base from '../layouts/Base.astro';
+import { catalog } from '../lib/catalog';
+---
+
+
+
+
OPEN DATA. NO KEYS REQUIRED.
+
+ Built for your workflow.
+
+
+ The same LOLBAS data, ready for your tools. Access all {catalog.length}{' '}
+ entries as JSON, CSV, or the original YAML.
+
+
+
+
+ 01 / JSON
+
Every entry. One file.
+
+ The JSON API keeps the existing URL and field structure. Each record
+ includes its name, description, author, creation date, commands, full
+ paths, detections, resources, and canonical page URL. Optional top-level
+ fields retain null values when absent.
+
+ One row per command example, with the existing 17 columns: filename,
+ entry metadata, command metadata, ATT&CK technique, operating
+ systems, paths, detections, resources, acknowledgements, URL, and tags.
+
+ YAML files in the project repository remain the source of truth. Browse
+ the four published collections, review changes, and contribute through
+ GitHub.
+
+ Download the{' '}
+
+ Navigator layer
+ {' '}
+ to explore command mappings. Scores represent the number of command
+ examples mapped to each technique.
+
+
+ Data is generated at build time from the repository. No API key, cookies,
+ or account needed. See the project{' '}
+
+ licensing notice
+ {' '}
+ for attribution and reuse.
+
+
+
+
diff --git a/website/src/pages/functions.astro b/website/src/pages/functions.astro
new file mode 100644
index 000000000..07ee92c02
--- /dev/null
+++ b/website/src/pages/functions.astro
@@ -0,0 +1,26 @@
+---
+import { sitePath } from '../lib/site';
+import Base from '../layouts/Base.astro';
+import { categories } from '../lib/catalog';
+---
+
+
+
+
+
+ ))}
+
+
diff --git a/website/src/pages/index.astro b/website/src/pages/index.astro
new file mode 100644
index 000000000..885ebc965
--- /dev/null
+++ b/website/src/pages/index.astro
@@ -0,0 +1,139 @@
+---
+import { sitePath } from '../lib/site';
+import Base from '../layouts/Base.astro';
+import Growth from '../components/Growth.astro';
+import Explorer from '../components/Explorer.astro';
+import { catalog, techniques, categories } from '../lib/catalog';
+const commands = catalog.reduce((sum, e) => sum + e.Commands.length, 0);
+const recent = [...catalog]
+ .sort((a, b) => b.Created.localeCompare(a.Created))
+ .slice(0, 3);
+---
+
+
+
+
+
+ Living Off The Land
+
+ Binaries, Scripts and Libraries
+
+
+ The tools are legitimate. The intent isn’t always.
+
+ Explore the Windows binaries, scripts, and libraries that turn
+ everyday functionality into unexpected
+ capabilities.
+
+
diff --git a/website/src/pages/insights.astro b/website/src/pages/insights.astro
new file mode 100644
index 000000000..be8c04465
--- /dev/null
+++ b/website/src/pages/insights.astro
@@ -0,0 +1,128 @@
+---
+import { sitePath } from '../lib/site';
+import Base from '../layouts/Base.astro';
+import Growth from '../components/Growth.astro';
+import { catalog, categories, typeLabels, techniques } from '../lib/catalog';
+const distribution = categories
+ .map((category) => ({
+ category,
+ count: catalog.filter((e) =>
+ e.Commands.some((c) => c.Category === category),
+ ).length,
+ }))
+ .sort((a, b) => b.count - a.count);
+const coverage = catalog.filter((e) =>
+ e.Detection?.some((d) => Object.keys(d).some((k) => k !== 'IOC')),
+).length;
+---
+
+
+
+
FOLLOW THE RESEARCH
+
+ The bigger picture.
+
+
+ How the catalog grows. What the tools can do. Where detection resources
+ exist.
+ A view of the community’s research, grounded in the source data.
+
+ Count of entries with at least one command in each category. An entry
+ can have multiple functions, so these counts overlap.
+
+
+
+
TURN RESEARCH INTO DEFENSE
+
Detection resources.
+
+ {coverage}
+ / {catalog.length}
+
+
+ Entries with at least one published detection link, such as Sigma,
+ Elastic, Splunk, analysis, or block rules. IOC-only entries are
+ excluded. Links are research leads; coverage does not guarantee that a
+ technique will be detected.
+
}){kind=logo}
+ LOLBAS