Living off the land (LotL) is an attack approach in which intruders use legitimate tools already present in the target system – such as PowerShell, WMI or remote administration utilities – instead of bringing their own malware.
How living-off-the-land attacks work
Every Windows, Linux and macOS system ships with powerful administration tools. Attackers abuse them for every stage of an intrusion:
- Execution – PowerShell, cmd, wscript, mshta, rundll32;
- Download and decoding – certutil, bitsadmin, curl;
- Discovery and lateral movement – net, nltest, WMI, PsExec, RDP, SSH;
- Credential theft – dumping LSASS memory with built-in comsvcs.dll;
- Persistence – scheduled tasks, services and WMI subscriptions.
Such dual-use programs are called LOLBins (living-off-the-land binaries); the community LOLBAS and GTFOBins projects catalogue hundreds of them. Attackers also abuse legitimate commercial tools such as AnyDesk or ScreenConnect.
Why it matters
LotL activity looks like normal IT administration and leaves no malicious files for antivirus to find, so it is closely related to fileless malware. In 2023–2024, CISA and partner agencies warned that the Chinese state-sponsored group Volt Typhoon relied almost entirely on living-off-the-land techniques to stay hidden for years in US critical infrastructure networks. Ransomware affiliates use the same approach before deploying encryption, and LotL is now standard for APT groups.
How to defend
- Enable detailed logging: process creation with command lines, PowerShell script blocks, WMI activity.
- Establish a baseline of normal admin tool usage and hunt for deviations; threat hunting is often the only way to find LotL intrusions.
- Restrict who can run admin tools, use application control and PowerShell Constrained Language Mode.
- Use EDR rules that focus on suspicious behaviour chains rather than file signatures.
