Living off the land (LotL) means carrying out an attack with tools that are already present on the target system, instead of bringing in custom malware. Attackers use built-in command shells, scripting engines, admin utilities and signed system programs. Because these tools are trusted and used every day, malicious activity can look like normal administration.

How it works

• Attackers run commands through built-in command shells, scripting engines and system management interfaces.
• They abuse signed system binaries, often called LOLBins, to run code or download files (MITRE ATT&CK T1218).
• They use legitimate remote access and admin tools for lateral movement.
• Little or no new software is written to disk, which makes file-based detection harder.

Why it matters for defenders

Joint guidance from CISA and partner agencies explains that LotL works well because many organizations cannot tell malicious use of these tools from legitimate use. Defenders need detailed logging, a baseline of normal admin behavior and restrictions on which users and systems may run powerful tools. Endpoint protection and behavior analytics such as UEBA help spot activity that does not fit. LotL often starts with valid accounts, so stolen credentials remain a key risk to watch.

Sources: CISA: Identifying and Mitigating Living Off the Land Techniques, MITRE ATT&CK T1218: System Binary Proxy Execution