Security researchers have exposed a new aspect in the Living Off the Land Binaries and Scripts (LOLBAS) arsenal: the little-known potential of Windows’ wevtutil.exe for stealthy, malicious operations. Tonmoy Jitu’s in-depth analysis sheds light on how this legitimate utility, designed for event log management, can become a dangerous tool in an attacker’s hands. Wevtutil.exe is a command-line tool bundled with Windows, primarily used by system administrators for event log management.
