Documentation

Comprehensive guides for using LOLAPI

📋 Data Format

Learn the YAML schema and structure of LOLAPI entries.

  • YAML Entry Structure
  • API Metadata Fields
  • Abuse Scenario Schema
  • Detection Signal Format
  • Risk Scoring Algorithm
View on GitHub →

🛡️ Detection Guide

Practical strategies for detecting LOTL API abuse.

  • Behavioral Detection
  • Forensic Analysis
  • Log-Based Detection
  • Sigma Detection Rules
  • SIEM Integration
View on GitHub →

🛡️ Mitigation Guide

Defense strategies and hardening techniques.

  • Policy-Based Mitigations
  • Technical Controls
  • AppLocker/CodeIntegrity
  • .NET Hardening
  • Process Monitoring
View on GitHub →

📚 API Catalog

Complete reference of documented APIs.

  • 10 Windows .NET APIs
  • 6 Windows COM Objects
  • 3 Native Windows APIs
  • 2 Browser Extension APIs
  • 3 Cloud Metadata Services
Browse APIs →

🤝 Contributing

Guidelines for submitting new APIs and improvements.

  • Submission Requirements
  • Quality Standards
  • Peer Review Process
  • Code of Conduct
  • Attribution & Credits
Read Guidelines →

❓ FAQ

Frequently asked questions about LOLAPI.

  • Why Living Off The Land?
  • How is Risk Calculated?
  • Difference from LOLBAS
  • Data Update Frequency
  • License Information
Read FAQ →

Quick Start

For Defenders

  1. Visit the API Browser
  2. Search for APIs relevant to your environment
  3. Review detection strategies for each API
  4. Implement detection rules in your SIEM
  5. Test and tune for false positives

For Researchers

  1. Clone the repository
  2. Review the YAML schema and existing entries
  3. Add new APIs or improve existing ones
  4. Follow the quality standards
  5. Submit a pull request

For Red Teamers

  1. Review abuse scenarios for your target platform
  2. Understand detection evasion techniques
  3. Study risk scores and prevalence data
  4. Map to MITRE ATT&CK techniques
  5. Integrate into your tools and playbooks