diff --git a/yml/OtherMSBinaries/lli.yml b/yml/OtherMSBinaries/lli.yml new file mode 100644 index 00000000..affe4947 --- /dev/null +++ b/yml/OtherMSBinaries/lli.yml @@ -0,0 +1,31 @@ +--- +Name: lli.exe +Description: LLVM Interpreter and Just-In-Time (JIT) compiler for executing LLVM + bitcode files (.bc or .ll) +Author: Munaf Shariff +Created: 2025-11-03 +Commands: + - Command: lli.exe payload.ll + Description: Executes LLVM Intermediate Representation (.ll) or Bitcode (.bc) + using the MCJIT or ORCJIT engine, allowing dynamic runtime code execution. + Part of Visual Studio and other external LLVM toolchains used by + developers. + Usecase: Can bypass static detection by interpreting or JIT-compiling obfuscated + LLVM IR (converted from multiple language source frontends) at runtime. + Category: Execute + Privileges: User + MitreID: T1127 + OperatingSystem: Windows + Tags: + - Execute: LLVM IR +Full_Path: + - Path: C:\Program Files\Microsoft Visual + Studio\2022\Community\VC\Tools\Llvm\x64\bin\lli.exe + - Path: C:\ProgramData\chocolatey\lib\llvm\tools\llvm\bin\lli.exe +Resources: + - Link: https://github.com/m3rcer/IRvana/blob/main/Interpreters/lli%20-%20ORC%20JIT/README.md#llvm-lli-tool-part-of-llvm-toolchain + - Link: https://github.com/m3rcer/IRvana + - Link: https://rohannk.com/posts/Code-in-the-Middle/ +Acknowledgement: + - Person: Munaf Shariff + Handle: "@al3x_m3rcer"