Added lli.yml

yml/OtherMSBinaries/lli.yml

@@ -0,0 +1,31 @@
+---
+Name: lli.exe
+Description: LLVM Interpreter and Just-In-Time (JIT) compiler for executing LLVM
+  bitcode files (.bc or .ll)
+Author: Munaf Shariff
+Created: 2025-11-03
+Commands:
+  - Command: lli.exe payload.ll
+    Description: Executes LLVM Intermediate Representation (.ll) or Bitcode (.bc)
+      using the MCJIT or ORCJIT engine, allowing dynamic runtime code execution.
+      Part of Visual Studio and other external LLVM toolchains used by
+      developers.
+    Usecase: Can bypass static detection by interpreting or JIT-compiling obfuscated
+      LLVM IR (converted from multiple language source frontends) at runtime.
+    Category: Execute
+    Privileges: User
+    MitreID: T1127
+    OperatingSystem: Windows
+    Tags:
+      - Execute: LLVM IR
+Full_Path:
+  - Path: C:\Program Files\Microsoft Visual
+      Studio\2022\Community\VC\Tools\Llvm\x64\bin\lli.exe
+  - Path: C:\ProgramData\chocolatey\lib\llvm\tools\llvm\bin\lli.exe
+Resources:
+  - Link: https://github.com/m3rcer/IRvana/blob/main/Interpreters/lli%20-%20ORC%20JIT/README.md#llvm-lli-tool-part-of-llvm-toolchain
+  - Link: https://github.com/m3rcer/IRvana
+  - Link: https://rohannk.com/posts/Code-in-the-Middle/
+Acknowledgement:
+  - Person: Munaf Shariff
+    Handle: "@al3x_m3rcer"