detecting-living-off-the-land-with-lolbas

Pass

Audited by Gen Agent Trust Hub on Mar 16, 2026

Risk Level: SAFE
Full Analysis
  • [SAFE]: The Python script scripts/agent.py performs local processing of log files using standard Python libraries.
  • Evidence: The script uses json.loads to parse process telemetry and json.dump to save its report. It does not import modules for network communication or subprocess execution.
  • Capability: No high-risk capabilities such as arbitrary command execution or external data transmission were identified.
  • [SAFE]: External references point to well-known cybersecurity resources such as the LOLBAS project on GitHub and the Sigma rule ecosystem.
  • Evidence: References to https://lolbas-project.github.io/ and https://github.com/LOLBAS-Project/LOLBAS.git are directed at trusted community-driven repositories for threat researchers.
Audit Metadata
Risk Level
SAFE
Analyzed
Mar 16, 2026, 03:03 AM