Hey all I’m Sharon, a cybersecurity researcher and malware analyst. Over the years analyzing real-world adversary intrusions, one tactic consistently creates friction for defenders: Living-off-the-Land Binaries (LOLBins). Attackers routinely bypass traditional antivirus and EDR signatures by weaponizing trusted, pre-installed utilities (certutil, mshta, bash, osascript, etc.). Why I built LOLPulse? Whenever SOC analysts or detection engineers encounter a suspicious process, the workflow is frustratingly fragmented: Scattered resources: You have to jump across separate websites—LOLBAS for Windows, GTFOBins for Linux, and LOOBins for macOS. Manual deobfuscation: Attackers use caret escapes (c^e^r^t^u^t^i^l.exe), base64 blobs, or environment variables to evade static grep. Detection fatigue: Translating an abused command into production SIEM rules requires tedious manual writing. I built LOLPulse to turn static documentation into a live, interactive detection laboratory.

LOLPulse

Unified LOLBins catalog & threat deobfuscation engine

Unified LOLBins catalog & threat deobfuscation engine