Living Off the Land (LotL)

How Attackers Use It

Attack Summary

Using built-in OS tools (PowerShell, WMI, certutil, curl, cron) to carry out malicious actions, blending in with normal system behaviour to evade signature-based detection.

• Adversary identifies built-in binaries that can execute, download, or persist.
• Commands are chained to avoid custom malware deployment.
• Activity blends with administrative operations to evade signatures.
• Persistence and lateral movement continue through trusted tools.

Defensive Strategy

Defense Summary

Behavioural detection / EDR (not just signatures). Script-block logging for PowerShell. Constrained Language Mode. Application allowlisting.

• Enable deep endpoint telemetry and behavior-based detections.
• Constrain script execution policies and disable unused admin tools.
• Implement allowlisting and signed-script requirements.
• Hunt regularly for suspicious process chains and command lines.

Detection Signals

• Abnormal parent-child process trees for scripting engines.
• Administrative binaries executing encoded or obfuscated commands.
• Unexpected remote command execution over WMI, WinRM, or SSH.

Internal Resources

• How-To Guides
• Blog
• General Knowledge