Skip to content

Living off the land

Also known as LOLBins

Attacker technique of using the legitimate tools already installed on a system instead of bringing their own malware.

PowerShell, WMI, certutil, and the remote management tooling an IT team relies on are all capable of doing an attacker's work. Using them means no unusual file to scan and activity that blends into normal administration.

This is why file-based detection alone leaves a large gap. Catching it requires baselining what normal administrative activity looks like in your environment and alerting on the unusual, such as PowerShell reaching out to the internet from a reception desk workstation.

Where this comes up

Living off the land sits inside our cybersecurity and threats work. If you are trying to work out what this means for your own environment rather than in the abstract, that is the page worth reading next, and a short call will get you a straight answer faster than either.

Want this explained against your own setup?

Definitions only get you so far. Book a short call and we will tell you whether this actually matters for your business, and what we would do about it.

Call (855) 737-9500 / (480) 573-3349

Email [email protected]

15-minute response on critical issues, 24/7. Onboarding in two to three weeks.

We reply within one business day. No spam, no pressure.