Suggestion / Request - Fileserver Resource Manager

[wilmerism]

Am looking at these files getting into locations they shouldnt be.
Ive made a FSRM file group containing these files. If they get put on network shares we get alerts.

Am after making a power shell line something like >

New-FsrmFileGroup -name "lolbins" -IncludePattern @((Invoke-WebRequest -Uri "https://lolbas-project.github.io/api/lolbas.json").content)

Any pointers / suggestions pls?

[pardhuvarmax]

LOLBAS FSRM Integration Script

I wanted to share this, "a working PowerShell solution" that uses the LOLBAS JSON API to dynamically populate an FSRM File Group. This helps monitor or block Living-Off-the-Land binaries from being written to protected shares.

# Requires: File Server Resource Manager PowerShell module
# Tested on Windows Server 2019 with FSRM

Import-Module FSRM

$groupName = 'LOLBAS-Files'
$lolbas = Invoke-WebRequest -Uri 'https://lolbas-project.github.io/api/lolbas.json' -UseBasicParsing |
           ConvertFrom-Json

# Build wildcard include patterns like *at.exe, *regsvr32.exe, etc.
$patterns = $lolbas.Name | ForEach-Object { "*$($_)" }

# Create or update the file group
if (Get-FsrmFileGroup -Name $groupName -ErrorAction SilentlyContinue) {
    Set-FsrmFileGroup -Name $groupName -IncludePattern $patterns
} else {
    New-FsrmFileGroup -Name $groupName -IncludePattern $patterns -Description 'LOLBAS living-off-the-land binaries'
}

# Optional: Attach to a file screen or schedule it weekly via Task Scheduler

Notes:

• Can be run manually or scheduled weekly to stay updated.

• Consider splitting patterns into smaller file groups if you hit FSRM pattern limits.

• You can optionally attach this file group to alerts, email actions, or automatic blocking rules.

if you want to simplify it into a one-liner version:

New-FsrmFileGroup -Name "lolbins" -IncludePattern @( (Invoke-RestMethod "https://lolbas-project.github.io/api/lolbas.json").Name | ForEach-Object { "*$($_)" } )

This works only if the group doesn’t already exist and you're okay skipping error handling / updates.

But Honestly, I wont recommend this, cause

The one-liner version using PowerShell to create an FSRM file group from the LOLBAS API isn't recommended because it's fragile and lacks safety measures. While it may work in simple scenarios, it doesn't include error handling, so if the API is down or the JSON structure changes, it will fail silently or break. It also assumes that every item has a .Name field without checking, making it prone to failure if the schema changes. Additionally, it doesn’t account for FSRM’s 4095-character limit for include patterns, meaning it could silently truncate or reject long lists. Finally, it's harder to read, debug, or maintain — especially if something goes wrong or if changes are needed later. For these reasons, a longer, step-by-step script with validation, logging, and split groups is safer and more reliable for real-world use.

⚠️ Possible Issues or Adjustments

Issue	Fix
❌ API is down / JSON structure changes	Wrap the request in a try/catch and validate structure
❌ Too many patterns for FSRM	Split into multiple groups (FSRM has a 4095-character limit per file group)
❌ Doesn’t run on Windows 10+ without FSRM role	Only works on server editions with File Server Resource Manager