Every attacker technique catalog is written for laptops. Servers are a different world: different binaries, different parents, different normal. This one is for the servers your business actually runs on.
Most threat libraries are written for laptops. This one is written for servers, not laptops, because the techniques differ and the assumptions that hold on an endpoint do not hold on a domain controller or a database host.
Living off the land is an attack technique that uses the legitimate tools already installed on a system rather than introducing new malware. PowerShell, WMI, certutil, regsvr32 and dozens of other signed, trusted binaries can be used to move laterally, establish persistence and stage data. Because the binaries are legitimate and signed, signature-based detection has nothing to match on, and behavioral detection has to distinguish malicious use of an admin tool from ordinary use of the same tool by an administrator.
An enterprise server runs a narrower and more predictable set of software than a laptop, which is an advantage defenders rarely use. The set of binaries that should ever execute on a production database host is small and stable. The set that actually can execute is enormous. That gap is the attack surface this library catalogs.
Detection asks whether an action looks malicious. On a signed system binary used by an administrator every day, that question is genuinely hard. Known-good enforcement asks whether the change the tool is attempting was authorized. A trusted binary can be used for authorized tasks and still be blocked from making an unauthorized change, because the decision evaluates the change rather than the tool or the credential behind it.
Related reading: The Patch Window, The Exploit Path, and the Known-Good Enforcement Glossary.
The live view below catalogs observed server-side techniques and the trusted binaries associated with them. Sources include LOLBAS, GTFOBins and MITRE ATT&CK.
None of these are malware. Every one ships with the operating system or your management stack, which is exactly why they get used — and why signature tools stay quiet. What gives them away is the parent process and the command line, not the file.
Pick an application to see the executables it ships, or search an executable by name to see what it is and who makes it. Drawn from the catalog Mimic builds across production servers — the question VirusTotal doesn't answer: not "is it malware," but "what is this, on a server?"
Aggregated across monitored servers, floored at fleet-wide prevalence — never traceable to a single customer.
A live read of the software Mimic sees across production servers. These numbers move as the fleet grows — check back.
Aggregated across monitored servers, floored at fleet-wide prevalence — never traceable to a single customer.