A LOLBAS downloader is a trusted binary or script that retrieves a file from a remote source, often as a precursor to malware delivery. A LOLBAS executor is a trusted component that launches code or a payload, helping attackers run malicious tools through a seemingly legitimate process tree. Both abuse trust, but they support different phases of the attack chain.
How the two terms split the attack chain
Downloader and executor describe different roles inside the same abuse pattern. The downloader is focused on retrieval: it uses a trusted binary to fetch a remote payload, which helps attackers stage content without dropping an obvious custom downloader. The executor is focused on execution: it uses a legitimate process to launch code, scripts, or a payload so the malicious action inherits the trust of the parent process.
The practical difference is where the attacker is operating in the chain. A downloader usually solves delivery and staging. An executor usually solves launch and containment evasion, because the malicious payload can run through a benign parent process tree and look less suspicious than a standalone binary.
In many cases the same LOLBAS can do both jobs, but the distinction still matters for triage. If you see a trusted utility making outbound requests and writing a new file, you are looking at retrieval behaviour. If you see the utility spawning interpreters, shell commands, or encoded arguments, you are looking at execution behaviour. Those are different signals even when they occur in the same incident.
Why the distinction matters for detection and response
Downloader activity often leaves the most useful evidence in network and file telemetry: remote destinations, file writes, hash changes, and unusual parent-child relationships around the staged artifact. Executor activity usually leaves stronger process telemetry: command lines, child processes, script hosts, and anomalous execution paths that show a legitimate binary was used as a launch vehicle.
That means defenders should not treat every LOLBAS event as the same problem. A download-only event may be an early warning that the payload has not yet executed. An execution event often indicates the attacker has crossed into active code run, which generally raises urgency because persistence, credential access, and lateral movement may follow quickly after the first launch.
For a practical baseline, many teams pair process-tree review with a review of the parent binary's normal behaviour. Legitimate administration tools can retrieve files and execute helpers in normal operations, so the key question is whether the action fits the expected use case, the expected target, and the expected timing. A trusted binary doing an unexpected retrieval from an external host is very different from the same binary launching a signed administrative helper from an approved path.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK address the attack and risk surface, while CIS Controls v8 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | CIS 8 — Audit Log Management | LOLBAS retrieval and execution both depend on process and event logging to spot abuse. |
| CIS 10 — Malware Defenses | LOLBAS downloader and executor patterns are common malware delivery and launch techniques. | |
| CIS 6 — Access Control Management | Trusted binaries abused as downloaders or executors exploit excessive local privilege and execution rights. | |
| Recommendation — Enable detailed logging for process creation, command lines and file activity to expose LOLBAS download and execution chains. Detect and block suspicious trusted-binary downloads and child-process launches used to execute payloads. Restrict which users and processes can invoke powerful administrative binaries and script hosts. | ||
| MITRE ATT&CK | T1105 — Ingress Tool Transfer | A LOLBAS downloader is a trusted binary used to fetch remote payloads onto the system. |
| T1218 — System Binary Proxy Execution | A LOLBAS executor uses a trusted component to run malicious code through a legitimate process. | |
| Recommendation — Hunt for trusted utilities that retrieve files from external sources and stage them for later use. Investigate trusted-binary executions that spawn payloads or script interpreters from unusual parents or arguments. | ||
| NIST CSF 2.0 | PR.AC — Access Control | The abuse depends on legitimate binaries retaining too much execution authority on endpoints. |
| Recommendation — Limit which trusted tools can launch code or reach remote content from user workstations. | ||
Practitioner Guidance
What to prioritise: Separate retrieval from execution in your alert logic. A downloader finding should trigger review of the remote source, file write location, and follow-on execution; an executor finding should trigger review of child processes, command-line arguments, and any payload that was launched.
What to verify: Confirm whether the parent process, target host, and file path match a documented administrative workflow. If the process is legitimate but the source, child process, or argument pattern is not, treat it as suspicious even when the binary itself is approved.
What practitioners underestimate: The same trusted utility can perform both roles in one chain, so defenders should look for the transition point, not just the binary name. Once a downloader hands off to an executor, the incident has usually moved from staging into active abuse.
Practitioner takeaway: The key distinction is operational, not cosmetic, downloader activity brings the payload in, executor activity makes it run, and mature detection should look for the handoff between those two phases.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on September 18, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
