Skip to content
The Incident Ledger

Living off the land

noun · also LOTL, LOLBins, LOLBAS · CISA: Identifying and Mitigating LOTL Techniques

Attacking with tools already present on the victim's systems, such as PowerShell or WMI, so the activity blends in with normal administration.

Bringing custom malware into a network is risky: antivirus may catch it, and every new file is evidence. Living off the land (LOTL) avoids that by using what is already installed and trusted. On Windows, that means PowerShell, WMI, certutil, rundll32, schtasks, remote management tools and the like. The community-maintained LOLBAS project documents hundreds of legitimate Windows binaries and scripts that can be abused this way.

Because the same tools are used every day by administrators, LOTL activity does not trigger signature-based detection, and it is hard to tell apart from legitimate work without context. CISA and its partners have published joint guidance on the technique after several state-sponsored groups relied on it to stay hidden in critical infrastructure networks.

Example

An attacker runs certutil -urlcache -f to download a file from the internet, creates a scheduled task with schtasks to keep access, and uses WMI to run commands on other servers. Every one of these is a signed Microsoft tool, so no malware alert fires.

Why it matters for a SOC analyst

Detecting LOTL depends on knowing what normal looks like: which accounts run PowerShell, from which hosts, with which kinds of command lines. Make sure process creation and command-line logging are enabled (through EDR, Sysmon or Windows event 4688 with command lines), and hunt for legitimate tools used by unusual users, at unusual times or with unusual arguments.

Related terms

  • Fileless malware

    Malicious code that runs in memory or through legitimate tools like PowerShell, leaving few or no malicious files on disk to scan.

  • Lateral movement

    The techniques attackers use to move from the first compromised system to other systems and accounts inside a network.

  • EDR

    Security software on laptops and servers that records process, file and network activity, detects malicious behavior and lets analysts respond.

  • Threat hunting

    The proactive search for attackers who are already inside the environment but have not triggered any alert, usually starting from a hypothesis.

  • Privilege escalation

    Gaining higher permissions than an account was given, such as moving from a standard user to local administrator, domain admin or cloud global admin.