LOLBAS full sweep

invoke-lolbins.ps1 -Full

Runs the full LOLBAS sweep (invoke-lolbins) on the test host, validating detection coverage of abusable system binaries.

Run it in the purple team lab when you want to validate LOLBAS coverage in one pass: invoke-lolbins iterates through abusable system binaries (certutil, mshta, rundll32, regsvr32, bitsadmin, etc.) executing abuse variants, and the team checks which ones were detected. It's the massive living off the land validation: LOLBAS rule coverage measured in a sweep. In purple teaming, the full sweep answers 'which LOLBAS do we cover?' — the per-binary result feeds the matrix, and gaps are worked on.

Don't run it outside the lab: the sweep executes abuse variants (the actual activity) — the isolated test host is the place. And note: the full sweep generates noise and takes time (each binary with its variants): the window is planned, and the result is interpreted per binary. The tool (thewover's invoke-lolbins) covers the documented LOLBAS of the project — new ones are validated separately. Cleanup of sweep artifacts (downloaded files, processes) upon completion.