Living off the Land: Attacks That Only Use Your Own Tools

Living off the land (LOTL) is the practice of abusing legitimate, signed, pre-installed operating-system utilities and admin tools instead of deploying custom malware. By driving binaries defenders expect to see, adversaries execute code, download payloads, move laterally and persist while blending with normal administration — evading signature-based antivirus and frustrating allowlisting. On Windows these “LOLBins” include PowerShell, WMI/WMIC, certutil, rundll32, mshta, regsvr32, bitsadmin, msiexec and PsExec; the community LOLBAS project catalogues them, and GTFOBins catalogues the Unix equivalents. LOTL is the signature playbook of PRC actor Volt Typhoon and is pervasive across ransomware operations.

How It Works

There is no single LOTL technique — it is a style spanning many. The closest umbrella is System Binary Proxy Execution (T1218, with sub-techniques for mshta, regsvr32, rundll32 and msiexec), frequently co-occurring with scripting (T1059.001 PowerShell, T1059.003 cmd), WMI (T1047), BITS jobs (T1197), ingress transfer via certutil/bitsadmin (T1105), service execution via PsExec (T1569.002) and decoding (T1140).

Reference Catalogs

The LOLBAS project (Windows) and GTFOBins (Unix) enumerate which binaries can be abused and how; dual-use frameworks such as Cobalt Strike, Impacket (wmiexec/smbexec), Metasploit and PsExec lean heavily on LOTL behaviour.

Detection & Mitigation

• Favour behavioural and anomaly detection over signatures — baseline legitimate admin behaviour and alert on deviations (the core message of the February 2024 CISA LOTL guidance).
• Enable rich logging: PowerShell script-block and module logging, command-line process-creation auditing (Event ID 4688) and Sysmon; centralise it.
• Apply application control (WDAC or AppLocker), including blocklists for LOLBins not needed on a host, and enforce PowerShell Constrained Language Mode where possible.
• Constrain dual-use binaries (certutil, bitsadmin, mshta, regsvr32) and reduce local-admin sprawl to limit which tools attackers can leverage.