Living off the Land LOTL

Living off the land is the attacker’s answer to antivirus. Rather than dropping a malicious executable that a scanner might recognize, the attacker uses the software that is already on the machine and trusted by the operating system — PowerShell, Windows Management Instrumentation, certutil, rundll32, Remote Desktop, the built-in administrative tooling your own IT team uses every week.

Nothing malicious lands on disk. There is no file to quarantine, no hash to blocklist, no signature to write. From the endpoint’s perspective, an administrator ran an administrative command.

Why this defeats signature-based defenses

Traditional antivirus answers one question: is this file on a known-bad list? LOTL never gives it a file to ask about. The malicious element is not the tool — PowerShell is not malware — it is the sequence and the context: a script host spawned by a document reader, an admin utility invoked from a user account that has never touched it, credential material read from memory by a process that has no business there, remote-desktop movement between two workstations at 2 AM.

Catching that requires behavioral detection (EDR) rather than file inspection, and it requires correlation across identity, endpoint, and network signals (XDR) to distinguish “the IT contractor is working late” from “someone is walking through the estate with the IT contractor’s password.”

What a LOTL intrusion typically looks like

The pattern is consistent enough to be recognizable:

1. Access — a valid credential, usually via phishing, password reuse, or an unpatched edge device such as a VPN appliance
2. Discovery — built-in commands enumerate the network, shares, and privileged accounts
3. Credential access — memory-resident tooling harvests hashes or tokens from a compromised host
4. Lateral movement — RDP, WMI, or remote PowerShell to reach the systems that matter
5. Impact — ransomware deployment, data theft, or quiet long-term persistence

CISA has documented state-sponsored actors maintaining access to critical-infrastructure networks for years using exactly this approach, specifically because it produces so little of what conventional monitoring is built to notice.

What actually works against it

• Behavioral detection on every endpoint — the only layer that sees the sequence rather than the file
• Least privilege, enforced — most LOTL chains need administrative rights to be interesting; standard users break the chain early
• Application control on the interpreters — constrained-language PowerShell, blocked script hosts, and restrictions on the specific binaries attackers reuse
• MFA everywhere, including administrative and remote access — LOTL almost always begins with a valid credential
• Someone watching — a lone LOTL signal is ambiguous by design. Deciding whether it’s the sysadmin or an intruder is a judgment call, which is why this class of attack is the strongest practical argument for MDR rather than tooling alone.

The honest framing: no product blocks living-off-the-land attacks the way a scanner blocks a virus, because there is nothing categorically bad to block. What you are buying is the ability to notice an unusual sequence quickly and act on it — which is a detection-and-response problem, not a prevention problem.