LOLBAS
The catalogue of signed Windows programs that can be made to do something entirely other than intended — download files, execute code, bypass allowlists.
The acronym stands for Living Off The Land Binaries, Scripts and Libraries, and the project systematically lists which built-in tools have unexpected capabilities. certutil.exe exists for certificate management but will happily fetch a file from the internet and decode base64. mshta.exe runs HTML applications, meaning scripts. regsvr32.exe can retrieve and execute code from a URL, which for years was the easiest route past AppLocker. The appeal is that the binaries are signed by Microsoft, present on every machine and frequently already allowed. The defence therefore cannot be file signatures but has to be behaviour — which program launched which, and with what arguments. The Unix equivalent is GTFOBins.