Living off the Land (LOTL)

Living off the land (LOTL) is the practice of conducting an attack using the software already present and trusted on the victim's systems — PowerShell, mshta.exe, rundll32, WMI, scheduled tasks, remote-administration suites — instead of installing custom malware that a scanner might catch. The "land" is your own environment; the attacker eats what you have already provided. Because every tool involved is signed, legitimate, and used daily by administrators, the technique defeats defenses that hunt for malicious files rather than malicious behavior.

How it works

A typical LOTL chain starts with a human action rather than an exploit: a phishing attachment with a script inside, or a ClickFix-style fake-fix prompt that persuades the victim to paste a command into the Run dialog themselves. That command invokes a built-in binary — often called a LOLBin — which downloads and executes the next stage in memory, leaving little on disk. From there the attacker continues in the same style: native remote-management tools for lateral movement, built-in archiving utilities to stage data, legitimate cloud-sync clients for exfiltration. To most monitoring, each step resembles an administrator having a busy day, which is precisely how LOTL stretches dwell time from days into months. State-sponsored groups have used the approach to hide in critical infrastructure networks, and commodity criminals use it to deliver payloads from infostealers to ransomware.

How to defend against it

Shift detection from "is this file malicious?" to "is this behavior normal?" Enable PowerShell script-block logging and command-line auditing so the native tools leave a trail; alert on unusual parent-child process pairs (a browser or Office app spawning PowerShell is rarely legitimate); restrict or disable LOLBins that ordinary users never need, for example by closing the Run dialog via group policy; and baseline admin-tool usage so deviations stand out. Because the chain so often begins with a persuaded user rather than a vulnerability, train and simulate the delivery tricks — fake updates, fake CAPTCHA fixes, paste-this-command prompts — and build the reporting reflex that surfaces the attempt before the first command runs; our ClickFix defense guide covers the most common current variant in depth.