Living off the land
Also known as LOLBins
Attacker technique of using the legitimate tools already installed on a system instead of bringing their own malware.
PowerShell, WMI, certutil, and the remote management tooling an IT team relies on are all capable of doing an attacker's work. Using them means no unusual file to scan and activity that blends into normal administration.
This is why file-based detection alone leaves a large gap. Catching it requires baselining what normal administrative activity looks like in your environment and alerting on the unusual, such as PowerShell reaching out to the internet from a reception desk workstation.
Where this comes up
Living off the land sits inside our cybersecurity and threats work. If you are trying to work out what this means for your own environment rather than in the abstract, that is the page worth reading next, and a short call will get you a straight answer faster than either.