Using legitimate tools to further an attack capability

Introduction

Living Off the Land (LotL) is an attack technique in which an attacker uses legitimate tools, utilities and functionality that are already installed on a victim’s system to perform malicious activities.

Rather than introducing obvious malware or unfamiliar executables, the attacker abuses trusted operating-system features and administrative tools. This can make the activity considerably harder to distinguish from legitimate system administration.

LotL techniques are particularly common during post-exploitation, where an attacker has already gained some level of access and wants to discover systems, escalate privileges, move laterally, establish persistence or steal information while minimising their chances of detection.

What is Living Off the Land?

Traditional malware attacks often involve introducing malicious executables onto a target system. Security products can potentially identify these files through signatures, reputation checks or other indicators.

Living Off the Land takes a different approach – The attacker uses tools that the operating system or installed software already trusts.

Examples include:

• PowerShell – scripting, administration and command execution
• Windows Management Instrumentation (WMI) – system management and remote execution
• BITSAdmin – background file transfers
• Certutil – certificate management and file-handling functionality
• Rundll32 – execution of DLL functionality
• Reg.exe – Windows Registry manipulation
• Mshta.exe – execution of HTML Application content
• Task Scheduler – scheduled execution and persistence

These tools are not inherently malicious. They have legitimate administrative purposes. The problem occurs when an attacker uses them in an unexpected or malicious context.

How Do LotL Attacks Work?

A typical attack can follow a sequence such as:

Initial Access → Discovery → Execution → Privilege Escalation → Lateral Movement → Persistence → Data Theft

After gaining access to a system, the attacker may begin using native tools to perform their objectives. For example, rather than installing a separate remote administration program, an attacker could use PowerShell or WMI to execute commands.

Similarly, instead of deploying a dedicated file-transfer utility, they could abuse an existing Windows component such as BITS to transfer data.

This allows the attacker to operate using software that administrators and security systems already expect to see and are unlikely to trigger any security alerts.

Why do attackers use living off the land?

There are several reasons why LotL techniques are attractive to attackers.

1. They blend into legitimate activity

Administrative tools are routinely used by system administrators, making individual commands less suspicious.

2. They reduce the need for malware

An attacker may be able to accomplish their objectives without dropping a traditional executable onto disk.

3. They can bypass simplistic security controls

Security controls based primarily on blocking unknown or unsigned software may struggle when the attacker is using legitimate, signed Windows components.

4. They reduce forensic evidence

Using existing tools and functionality can reduce the number of obvious malicious files left behind.

5. They provide extensive functionality

Modern operating systems contain a large collection of administrative and scripting capabilities that can potentially be abused.

Common LotL Tools

There are potentially hundreds of LotL tools and utilities – a good reference to what tools are available and how they can be utilised can be found:

• Windows (LOLBAS)
• Linux (GTFOBINS)

PowerShell

PowerShell provides extensive scripting and administrative functionality.

Attackers can abuse it for:

• Command execution
• System discovery
• Credential access
• Downloading content
• Remote administration
• Persistence

Because PowerShell is widely used by legitimate administrators, simply seeing PowerShell execute is not necessarily evidence of an attack. Context is critical.

WMI

Windows Management Instrumentation provides management functionality that can also be abused for remote execution and system discovery.

Suspicious WMI activity can therefore provide an important indication of lateral movement or post-exploitation activity.

BITSAdmin

The Background Intelligent Transfer Service is designed to transfer files efficiently in the background.

Attackers can abuse this functionality to transfer malicious or stolen data while attempting to make the activity appear legitimate.

Certutil

Certutil is a legitimate Windows certificate-management utility.

Its functionality has also been abused by attackers for activities such as manipulating or transferring data.

Rundll32

Rundll32 is a legitimate Windows executable used to execute exported functions from DLL files.

Its ability to invoke DLL functionality makes it another example of a trusted binary that can be abused during an attack.

Mshta

Mshta is used to execute HTML Applications.

Attackers can abuse it to execute malicious content without necessarily introducing a conventional executable.

Why are LotL attacks difficult to detect?

The fundamental challenge is that the tools themselves are legitimate. Blocking PowerShell, WMI or Task Scheduler completely would also prevent legitimate administration and business operations.

Security teams therefore need to look beyond simply asking:

“Was PowerShell executed?”

Instead, they need to ask:

“Who executed PowerShell, from where, with what parent process, using which commands, against which system and at what time?”

This contextual approach is much more effective.

Indicators that may increase suspicion include:

• Unusual parent-child process relationships
• Administrative tools being launched by unexpected applications
• PowerShell launched by Office applications
• Commands executing under unusual user accounts
• WMI activity between systems that normally do not communicate
• Unexpected use of BITS
• Native utilities communicating with external systems
• Multiple administrative utilities being chained together
• Commands executed shortly after an initial compromise

Detecting living off the land

Effective detection requires monitoring behaviour rather than simply looking for malicious files.

Useful telemetry includes:

Windows Security Events

Process creation events such as Event ID 4688 can provide valuable information about which processes were launched and by which accounts.

PowerShell Logging

PowerShell logging can provide visibility into suspicious script execution and command activity.

Sysmon

Sysmon can provide particularly useful telemetry for LotL detection, including:

• Event ID 1 – Process Creation
• Event ID 3 – Network Connection
• Event ID 7 – Image Loaded
• Event ID 10 – Process Access

Correlating these events can reveal chains of activity that would otherwise appear legitimate when viewed individually.

Behavioural Analysis

Security teams should look for combinations of events rather than isolated commands.

For example: WINWORD.EXE → PowerShell → Network Connection → Credential Access

is considerably more suspicious than simply seeing PowerShell running on its own.

How can organisations defend Against LotL attacks?

Organisations can reduce the risk posed by LotL techniques through a combination of preventative and detective controls.

• Application Control – Application allowlisting can restrict which applications and scripts are permitted to execute.
• Least Privilege – Users and services should operate with the minimum privileges required to perform their tasks.
• PowerShell Security – Organisations should enable appropriate PowerShell logging and apply controls such as Constrained Language Mode where appropriate.
• Endpoint Detection and Response – EDR solutions can identify suspicious relationships between processes, users, commands and network connections.
• Network Segmentation – Segmentation can limit an attacker’s ability to use legitimate administrative protocols to move between systems.
• Logging and Monitoring – Centralised logging allows security teams to correlate activity across multiple systems.
• User and Administrator Monitoring – Privileged accounts should receive additional monitoring because their legitimate capabilities can provide attackers with significant opportunities.

Conclusion

Living Off the Land demonstrates why cybersecurity cannot rely solely on identifying known malicious files – An attacker does not necessarily need to introduce an obviously malicious program, they may instead use the tools that are already present on the system.

• PowerShell is legitimate.
• WMI is legitimate.
• BITS is legitimate.
• Rundll32 is legitimate.
• Task Scheduler is legitimate.

But legitimate tools can still be used to perform malicious actions.

The challenge for defenders is therefore to identify malicious behaviour occurring through legitimate functionality.

Remember:

Don’t just ask what tool was used. Ask who used it, how it was used, what it interacted with, and what happened immediately before and after.

That behavioural and contextual approach is fundamental to detecting Living Off the Land attacks.