Living Off the Land Attacks: How to Detect LOTL Activity

A living off the land (LOTL) attack is an intrusion carried out with the binaries, scripts, and admin tools already present and trusted in the target environment, such as PowerShell, WMI, and certutil. The attacker brings little or no malware of their own and blends in with legitimate administration. CISA describes LOTL as a defining trait of Volt Typhoon, which kept access to some victim IT environments for at least five years.

Detection rules for these techniques are public and plentiful. The hard part is deciding whether a specific execution came from your admin or from someone holding your admin's tools, since the same command can belong to either. The verdict comes from telemetry, organizational, and historic context: the account, the host, the approved exceptions, and the execution history.

TL;DR:

• Rule logic for LOTL is freely available, and much of the published documentation is about tuning, exclusions, and false positives. Deciding what a hit means is where programs struggle.
• Blocking core admin tools outright is rarely practical, since NSA, CISA, and NCSC guidance advises keeping PowerShell, and application control has known bypasses through other Microsoft-signed tools.
• Cloud and identity LOTL follows the same logic with fewer community catalogs, and a single Graph API call rarely looks suspicious by itself.
• The case closes on who ran the tool, from which host, under which change ticket, and whether that matches past behavior.

What a Living Off the Land Attack Is

LOTL works because the tools are already deployed and trusted in the environment, according to joint guidance from CISA, NSA, FBI, and international partners published in February 2024. The technique works across on-premises, cloud, hybrid, Windows, Linux, and macOS environments, and it spares attackers the cost of building custom tools. The same guidance names PsExec as a common LOTL tool, even though it files third-party remote access software in a separate category. Treat RMM agents and PsExec with the same skepticism you apply to certutil.

Much LOTL activity runs through LOLBins (living off the land binaries). The LOLBAS project catalogs the Windows ones, and an entry has to be Microsoft-signed, have unexpected functionality beyond its intended use, and be useful to an APT or red team. Sibling projects cover other platforms and tool types, including GTFOBins for Unix, LOOBins for macOS, LOLDrivers for Windows drivers, and LOLRMM for remote management tools.

The Tools Attackers Abuse Most

PowerShell sits at or near the top of most rankings. Red Canary's 2026 Threat Detection Report ranks it second among the ATT&CK techniques seen in confirmed threats during 2025, with Windows Command Shell third and WMI seventh. Impacket, an attacker-brought toolkit that drives native services such as WMI and SMB, accounted for about 36% of all tools in the incidents Sophos handled between November 2024 and October 2025.

1. PowerShell (T1059.001)

Attackers use PowerShell for downloads, in-memory execution, disabling defenses, and lateral movement. The -EncodedCommand switch, which can be shortened to -e or -ec, is the most common form of obfuscation Red Canary detects. Many administrators use encoded commands too, so a rule keyed on the switch alone can fill a queue with legitimate activity.

2. WMI (T1047)

WMI stays in Red Canary's top ten largely because of Impacket's WMIexec module. On the destination host, WMIexec leaves a recognizable pattern: wmiprvse.exe spawning cmd.exe /Q /c, with output redirected to a file on \\127.0.0.1\ADMIN$. The pattern is a staple of lateral movement investigations, though whether a common wmic command is malicious depends on context.

3. Certutil (T1105, T1140)

Certutil downloads files and decodes Base64 payloads. SigmaHQ's certutil download rule lists its false positives as "Unknown." Under Sigma's conventions, that label means the author knows of none. It doesn't indicate how often the rule fires on legitimate activity. Software deployment tools call certutil too, which is why ManageEngine suggests allowlisting the SCCM or deployment service account.

4. Rundll32 (T1218.011)

Red Canary has built more than 100 analytics for rundll32, including ones for comsvcs.dll MiniDump calls that often target LSASS. Public rules show how much tuning that coverage takes. The authors of SigmaHQ's Outlook child-process rule "ended up commenting out the rundll32.exe sub processes completely" after repeated false positives. Detections for schtasks /create will almost certainly need tuning and exclusions for legitimate software.

Why LOTL Evades EDR, AV, and SIEM

LOLBins that admins use legitimately carry trusted attributes such as file hashes and digital signatures, which can mislead defenders into treating them as safe for every user. Defenders also often keep default logging, rely on untuned EDR, and have few conventional IOCs to work from.

Running Windows generally requires allowing Microsoft-signed code, so an application control policy that allows Microsoft and denies a list of known LOLBins will miss the next one a researcher finds. Red Canary still recommends application control and argues that known bypasses shouldn't stop teams from deploying it.

Some techniques avoid writing a payload file at all. ClickFix commands pull payloads directly into memory, leaving a fileless process that traditional security tools often miss. Defender for Endpoint can still inspect fileless threats through AMSI and memory scanning. Detections built on strings or command-line arguments are fragile as well, because an attacker can trivially change those indicators, though SpecterOps argued in 2020 that such simple detections are still worth having.

Attackers also masquerade as familiar processes. In an October 2026 advisory, CISA and partner agencies described Chinese government-linked actors downloading SoftEther VPN installers through PowerShell or other LOTL binaries and renaming them conhost.exe or dllhost.exe.

Without a file to hash or sandbox, an investigator has little to anchor on. A clean sweep for indicators of compromise doesn't show the environment is uncompromised, especially when the attacker used built-in tools or changed infrastructure. Short retention compounds the problem. In BRICKSTORM cases, which averaged 393 days of dwell time, standard 90-day log retention left organizations unable to identify initial access.

LOTL in Cloud and Identity Environments

Cloud LOTL runs on the control plane. Control plane attacks made up about 47% of what Datadog observed in Q1 2025, up slightly from 44% the quarter before. Cloud threat actors often don't deploy malware at all and move through the control plane with compromised identities. Community catalogs such as lolol.farm, which aggregates the LOTS Project, LOLAPI, LOLC2, and LOLEXFIL lists, cover parts of this territory, but cloud coverage is more fragmented than the Windows catalog.

The cloud tools attackers reach for are the ones admins use daily. Azure Run Command serves legitimate administration and also runs attacker scripts. Silk Typhoon abused service principals and OAuth apps to pull email, OneDrive, and SharePoint data through Microsoft Graph. In Kubernetes, the commands run through kubectl exec are rarely logged. Audit logs, when enabled, record the exec request, and host-level auditing is needed to see the commands themselves.

Graph abuse rarely looks suspicious one API call at a time, and Microsoft's September 2026 analysis of a passkey-themed campaign showed the calls only form a clear reconnaissance-to-exfiltration chain together. Hybrid environments add a correlation step. AWS redacts SSM SendCommand parameters in CloudTrail, so recovering the actual commands means joining those events with endpoint process execution, the same correlation cloud incident response depends on.

Why Business Context Decides the Verdict

Each context type answers a different part of the admin-or-attacker question. Telemetry shows what ran and who ran it, organizational context covers policies and approved exceptions, and historic context shows whether the activity matches past behavior. LOLBins aren't malicious by nature, and where, when, and how one runs is what can make it suspicious. PowerShell on a non-technical user's workstation warrants a closer look than the same command on an IT admin's machine.

Change tickets are a good first check, since legitimate privileged changes are usually documented somewhere. Approved exceptions show which PsExec or admin-tool use is allowed, and for whom. Asset ownership identifies what the system does and who owns it. Historic baselines show what past investigations concluded about a similar pattern, and why. Identity and role establish whether an account normally touches a given utility.

CISA's August 2026 red team assessment of two organizations shows what goes wrong without that context. At one organization, defenders couldn't identify the owner of an SCCM server tied to an alert the red team triggered and dismissed it as a false positive. Analysts there also lacked escalation procedures and the authority to act. Actual intrusions exploit the same gap. Octo Tempest registered legitimate Microsoft 365 backup products such as Veeam and CommVault to export SharePoint content.

A Remote Desktop logon (event ID 4624, logon type 10) means one thing on a developer workstation and another on a domain controller, so baselines have to be scoped per host and per credential. Teams that can't say whether an activity is normal for a given host end up guessing.

What Hardening Buys You

Hardening shrinks the attack surface without settling the verdict. Microsoft has removed WMIC from currently supported versions of Windows 11, though WMI itself remains and Get-CimInstance still works. The legacy PowerShell 2.0 engine is gone from Windows 11 24H2 and Windows Server 2025, and current versions remain available.

In June 2022 guidance, the NSA, CISA, and the UK's NCSC recommended that organizations keep PowerShell and configure and monitor it. Because that advice dates from 2022, check it against current Microsoft documentation before applying it.

Under an enforced App Control policy, interactive PowerShell sessions run in Constrained Language Mode and untrusted scripts are blocked or constrained. App Control has gaps of its own, and Microsoft's list of applications that can bypass it includes mshta.exe, msbuild.exe, and wmic.exe. The ASR rule that blocks process creation from PsExec and WMI commands supports only limited exclusions. Test it in audit mode before blocking.

How to Detect Living Off the Land Attacks: Where to Start

For many teams the gaps sit in baselines, logging, and retention more than in rule count, and the baseline comes first because every later step needs something to compare against:

• Baseline which tools your admins run, from which hosts, and when. The joint guidance recommends baselining privileged accounts this way, and most later rules depend on the profile.
• Move past default logging with PowerShell Script Block Logging (event 4104), full command-line capture, and Sysmon events 19, 20, and 21. Those Sysmon events record WMI persistence subscriptions only, so pair them with process creation logs, and ship everything out of band to write-once storage that adversaries can't tamper with.
• Measure a noisy candidate rule's volume against offline data before alerting on it, as Red Canary advises for encoded PowerShell.
• Extend retention past 30 or 90 days. Defender XDR keeps 30 days of raw advanced hunting data, and a security data lake with longer retention changes what an investigation can answer.
• In significant cloud environments, correlate control plane logs with endpoint telemetry, and judge each API call against the principal's normal behavior.
• Replace quarterly lists of hunt titles with hypothesis-driven hunts that have testable outcomes, using a framework such as Splunk's PEAK.

Each step also widens what a threat hunt can test.

Why LOTL Hunting Has to Run Continuously

Alert-driven investigation only reaches LOTL activity that some rule already flagged, and much of it may never trip one. Splunk's PEAK framework, published in 2023, defines hunting as finding the security incidents an organization's automated detection systems missed, which fits the LOTL gap closely. In the SANS 2026 Threat Hunting Survey, 73% of respondents named LOTL techniques as the top method nation-state actors use. The same survey found data quality had overtaken skilled staffing as hunters' biggest barrier, and only 40% of programs formally measure whether their hunting works.

PEAK defines hypothesis-driven, baseline, and model-assisted hunts, and IOC sweeps still have a role in validating known threats. Templated query catalogs sit at the weak end, running queries with no hypothesis or baseline behind them. A hypothesis-driven hunt states something testable, for example that wmiprvse.exe is spawning shells on hosts with no SCCM management relationship, and reaches an outcome that proves or disproves it. The output becomes new detections and a list of data gaps.

Each hypothesis must be tested against far more activity than a person can baseline by hand. Quarterly hunts give LOTL dwell time too much room, which is the case for testing hypotheses continuously. Daylight is a MASS company, meaning it offers managed agentic security services for Security Operations. Its Threat Hunting service, scoped separately from MDR, pairs expert-defined hypotheses with agentic execution across endpoint, identity, and cloud data, and checks native-tool activity against organizational and historic context.

Frequently Asked Questions About Living Off the Land Attacks

Which MITRE ATT&CK Techniques Cover Living Off the Land?

No single technique does, and the per-tool techniques for PowerShell or WMI cover only part of it. System Binary Proxy Execution (T1218) groups the signed Windows binaries attackers run malicious content through, with sub-techniques for Mshta (T1218.005), Msiexec (T1218.007), and Regsvr32 (T1218.010). Masquerading (T1036) covers tools renamed to pass as system files. Mapping detections to these IDs shows coverage, but it doesn't show whether a hit was an admin or an attacker.

Is PsExec a LOLBin?

PsExec doesn't appear in the LOLBAS catalog, even though it is a Microsoft-signed Sysinternals tool. It likely fails the catalog's unexpected-functionality test, because remote execution is its intended purpose. Sophos lists it among its top "dual use" tools. The label matters less than the policy it drives, since CISA's red teams report encountering overly broad exceptions for PsExec, and those exceptions are the practical risk.

What Does CrowdStrike's 82% Malware-Free Figure Say About LOLBin Use?

Less than people assume. CrowdStrike's 2026 Global Threat Report found that 82% of 2025 detections were malware-free. Treat it as evidence that most detected intrusion activity involved no malware. It is not a measure of how much of that activity used LOLBins.

How Is a LOTL Attack Different From Fileless Malware?

LOTL describes which tools the attacker uses, and fileless describes where the payload lives. The two overlap heavily. Microsoft says there's no single definition of fileless malware and sorts it into three types by how much file activity it leaves: none, indirect, or files required to operate. Many fileless techniques run through built-in tools such as PowerShell, mshta, and WMI. An attack can still use those tools and drop files on disk, or stay fileless through an exploit with no admin tool involved.

Which Cloud Logs Matter Most for LOTL Investigations?

Start with control plane logs: AWS CloudTrail, the Azure Activity Log, and Google Cloud Audit Logs. The joint guidance recommends enabling logging for all control plane operations, including API calls and end-user logins, which makes identity provider sign-in logs part of the same set. In AWS, trails don't log data events such as S3 object access by default, and enabling them adds cost, so decide which buckets and functions need them before an investigation does.