A PowerShell script that automatically blocks "Living Off the Land" binaries using Windows Firewall to prevent malicious abuse of legitimate system tools.
Living Off the Land Binaries (LOLBins) are legitimate system binaries that can be abused by attackers to perform malicious activities while avoiding detection. This script fetches the latest list from the LOLBAS Project and creates Windows Firewall rules to block outbound network connections for these binaries.
- Fetches the latest LOLBAS data automatically
- Creates Windows Firewall rules to block outbound connections
- Includes exception list for commonly used legitimate binaries
- Prevents duplicate rule creation
- Provides detailed progress and completion statistics
- Comprehensive error handling and logging
- Windows 10/11 or Windows Server 2016+
- PowerShell 5.1 or later
- Administrator privileges (required for firewall rule creation)
- Internet connection (to fetch LOLBAS data)
- Run as Administrator - This is required for creating firewall rules
- Execute the script:
.\blol.ps1
The script will:
- Download the latest LOLBAS data
- Check for existing BLOL firewall rules
- Identify valid binary paths on your system
- Create firewall rules to block outbound connections
- Provide a summary of actions taken
The following binaries are excluded from blocking by default (commonly used legitimate tools):
chrome.exe- Google Chrome browserAppInstaller.exe- Windows App Installerwsl.exe- Windows Subsystem for Linuxcmd.exe- Command Promptupdate.exe- Various update utilitieswinget.exe- Windows Package Managermsedge.exe- Microsoft Edge browser- ...and more!
- Rule Name Format:
BLOL - [Binary Name] - Direction: Outbound
- Action: Block
- Profile: All (Domain, Private, Public)
- Status: Enabled
- Ensure you're running as Administrator
- Check PowerShell execution policy:
Get-ExecutionPolicy - If needed, temporarily allow script execution:
Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Scope CurrentUser
- Verify internet connection
- Check if corporate firewall is blocking access to
lolbas-project.github.io - Consider using a proxy if required
- Check for existing rules with similar names
- Use
Get-NetFirewallRule -DisplayName "BLOL - *"to view created rules - Remove rules if needed:
Remove-NetFirewallRule -DisplayName "BLOL - *"
To remove all BLOL firewall rules:
Get-NetFirewallRule -DisplayName "BLOL - *" | Remove-NetFirewallRuleThis script is based on original work by John Hammond and modified by myself (NodeMixaholic.)
- LOLBAS Project provides the list of binaries to block - don't bug me to add any!
- Report issues or suggest improvements through the appropriate channels
This tool is provided for educational and defensive security purposes. Users are responsible for testing in their environment and understanding the impact on their systems. The authors are not responsible for any system disruption or functionality loss.
SPL-R5