Living off the land
Also called: LOTL · LotL · living-off-the-land
An intrusion style where attackers avoid custom malware and instead use tools already built into the system, such as PowerShell, WMI or remote desktop, to explore, move laterally and steal data. Because the activity looks like normal administration, antivirus rarely flags it. Detection depends on centralized command-line and login logs and on knowing what normal admin activity looks like, so unusual accounts, times or sources stand out.
Further reading: www.cisa.gov
From the Security Academy
State-Sponsored Hackers (APT): Common Tradecraft, the Threat to Taiwan Companies, and Defensive Priorities
Not every breach is an APT. State hackers' edge-device, living-off-the-land, long-dwell and supplier tactics, how to read advisories, and what to fix first.
13 min read ·
Advisories that mention this term
No advisories mention this term yet.