Don't let cyberattacks disrupt your workflow. See what's at risk.
Utility navigation bar redirect icon
Portal LoginSupportBlogContact
Search
Portal LoginSupportBlogContact
Search
Get a Demo
Start for Free
HomeCybersecurity 101
Living off the Land Attacks

What are Living off the Land (LOTL) Attacks

Written by: Lizzie Danielson

Updated: 07/30/2026
Published: 9/7/2025

woman at laptop
ChatGPT logoChatGPTOpens in new tabClaude logoClaudeOpens in new tabPerplexity logoPerplexityOpens in new tabGoogle Gemini logoGoogle AIOpens in new tab
On This Page

Living Off the Land (LOTL) attacks are a type of cyberattack where threat actors use legitimate, trusted tools and software already present on a target system to carry out malicious activities. Instead of bringing their own malware, attackers exploit built-in system utilities, administrative tools, and legitimate applications to avoid detection and achieve their objectives.

Key Takeaways

By the end of this article, you'll understand:

  • The definition and core concepts of Living Off the Land (LOTL) attacks

  • Common tactics and legitimate tools used in LOTL attacks

  • Why these attacks are particularly difficult to detect and defend against

  • Proven strategies and best practices for defending against LOTL techniques

  • How security solutions like Huntress help protect organizations from these stealthy threats

Understanding LOTL Attacks

Think of LOTL attacks like a burglar using your own house key instead of breaking a window. Cybercriminals have figured out that using legitimate system tools is way smarter than dragging suspicious malware into your network. Why set off alarms when you can walk right through the front door?

These attacks get their name from the military concept of "living off the land"—using local resources instead of bringing your own supplies. In cybersecurity, this means attackers use PowerShell, Windows Management Instrumentation (WMI), legitimate administrative tools, and even applications like Microsoft Teams to accomplish their goals. These are often referred to as LOLBins (living off the land binaries).

The scary part? To most security systems, these activities look completely normal. When PowerShell runs a script, your antivirus doesn't immediately think "cyberattack"—it thinks "legitimate administrative task."

How Do LOTL Attacks Work?

LOTL attacks begin with attackers gaining initial access. One of the most common ways is through phishing. Attackers may attach a spoofed invoice to an email that causes a legitimate application like Word to spawn a tool such as PowerShell, which executes an encoded script. These commands can create scheduled tasks for persistence and run discovery. The attacker can then shift to a tool like PsExec or RDP to reach other systems and exfiltrate data.

A sharply rising threat involves tricking users into installing or approving remote monitoring and management (RMM) tools to gain trusted remote access. According to the Huntress 2026 Cyber Threat Report, RMM abuse jumped 277% year over year. In these attacks, threat actors may pose as IT support to convince victims to grant them access through tools like AnyDesk or ScreenConnect. Once approved, the attacker gains full control over the machine.

LOTL activity can also extend into cloud and identity environments. Attackers may use stolen Microsoft 365, VPN, or admin credentials to log in through legitimate access points. From there, they can create mailbox forwarding rules, abuse admin portals, approve malicious OAuth applications, access shared files, or move laterally through remote access tools.

Regardless of the exact methods or sequence used, the behavior at each step is designed to look like normal admin activity unless defenders correlate the full chain.

Common LOTL Tools and Techniques

Windows Environment Tools

PowerShell is probably the most popular tool in an attacker's LOTL toolkit. This powerful command-line interface can download files, execute commands, and move laterally through networks—all while looking like routine system administration.

Windows Management Instrumentation (WMI) lets attackers query system information, execute commands remotely, and maintain persistence. Since WMI is essential for legitimate system management, blocking it entirely isn't an option for most organizations.

Built-in Windows utilities like certutil.exe, bitsadmin.exe, and regsvr32.exe can be weaponized to download malicious payloads, maintain persistence, or execute code in ways their original developers never intended.

Linux and Unix Systems

The GTFOBins project catalogs how common Unix binaries can be exploited. Tools like cp, cat, and netcat—which system administrators use daily—can be turned into attack vectors.

Signed Drivers and Applications

The LOLDrivers project tracks legitimate, signed Windows drivers that contain vulnerabilities or can be abused for malicious purposes. Since these drivers have valid digital signatures, they can bypass many security controls designed to block unsigned code.

Why LOTL Attacks Are So Difficult to Detect

Stealth and Evasion

Traditional security tools look for known malware signatures and suspicious file behaviors. LOTL attacks flip this approach on its head by using tools that are supposed to be there. When a trusted application such as Microsoft Teams spawns a child process, many automated systems may think “legitimate business application,” not “potential security threat,” unless these tools evaluate the broader context.

Reduced Attack Surface Detection

Because attackers aren’t introducing new files or executables, there’s less evidence for security teams to find. The attack artifacts blend into normal system activity, making forensic analysis significantly more challenging. Reducing your organization’s attack surfaces by following our best practices helps mitigate your cyber risk.

Living in Plain Sight

According to multiple industry reports, LOTL techniques are involved in 70–85% of successful breaches. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has specifically warned about the increasing use of living-off-the-land techniques in targeted attacks against critical infrastructure.

Real-World LOTL Attack Examples

“Low and slow” attacks using LOTL techniques allow attackers to remain undetected for long periods. This is especially useful for state-sponsored actors, who can establish persistence in highly sensitive systems to gather data or plan disruptive attacks, such as on communications, transportation, and utilities systems. This was the case with Volt Typhoon, which used hands-on-keyboard commands and native LOLBins to maintain long-term access within US critical infrastructure environments.

But LOTL isn’t just used for espionage. Other high-profile living-off-the-land attack examples include the Medusa ransomware. This ransomware-as-a-service (RaaS) attack has affected over 300 organizations across the medical, education, legal, insurance, tech, and manufacturing sectors. Reported Medusa incidents have included the use of certutil.exe for file transfer and heavily obfuscated PowerShell commands to evade detection.

Read our deep dive into real-world LOTL attacks.

How to Defend Against Living off the Land Attacks

Behavioral Analysis and Monitoring

Instead of just looking for bad files, focus on unusual behaviors. Monitor for:

  • PowerShell executions with suspicious parameters

  • Unusual network connections from system utilities

  • Administrative tools running in unexpected contexts

  • Abnormal process relationships and command chains

Application Control and Whitelisting

Implement strict controls on how legitimate tools can be used:

  • Restrict PowerShell execution policies

  • Limit which users can run administrative utilities

  • Monitor and log all usage of high-risk legitimate tools

  • Use AppLocker or similar technologies to control script execution

Enhanced Logging and Visibility

Enable comprehensive logging for:

  • PowerShell script block logging

  • WMI activity monitoring

  • Process creation events

  • Network connections from system processes

  • Command-line arguments for all processes

Threat Hunting and Analysis

Proactively search for signs of LOTL activity:

  • Look for unusual patterns in legitimate tool usage

  • Analyze command-line arguments for suspicious parameters

  • Monitor for tools being used outside their normal operational context

  • Track lateral movement patterns using built-in utilities

How Huntress Protects Against LOTL Attacks

Huntress specializes in detecting the subtle signs of LOTL attacks that traditional security tools often miss. Our human-driven threat hunting approach combines advanced behavioral analysis with expert security analysts who understand how legitimate tools can be weaponized.

Our platform continuously monitors for suspicious use of built-in utilities, tracks unusual process behaviors, and identifies the telltale signs of living-off-the-land techniques. By correlating endpoint behavior, logs, and identity signals, our team of security experts looks deeper to spot the abnormal patterns that indicate a potential breach. As an additional layer of defense, our endpoint security posture management (ESPM) and identity security posture management (ISPM) tools help harden endpoints and identities to close the security gaps that often allow LOTL attacks to start.

Staying Ahead of Stealthy Threats

LOTL attacks represent a fundamental shift in how cybercriminals operate. By using the tools already in your environment, they’ve found a way to hide in plain sight. The key to defense isn’t just better technology—it’s a better understanding of how legitimate tools can be misused and implementing monitoring that focuses on behaviors rather than just files.

The cybersecurity landscape continues to evolve, and so do the tactics of threat actors. Understanding LOTL techniques and implementing appropriate defenses is essential for any organization serious about protecting its digital assets.

Ready to strengthen your defenses against these stealthy attacks? Discover how Huntress can help your organization detect and respond to living-off-the-land techniques before they become full-scale breaches.

ChatGPT logoChatGPTOpens in new tabClaude logoClaudeOpens in new tabPerplexity logoPerplexityOpens in new tabGoogle Gemini logoGoogle AIOpens in new tab
On This Page

Frequently Asked Questions

Traditional malware brings new, malicious files into your system. Living off the land cyber attacks use tools that are already there and supposed to be there, making them much harder to detect with signature-based security solutions.

You may have heard of “living off the land malware” and assumed your AV could stop it. However, calling LOTL “malware” misses the point of why these attacks were developed in the first place. Traditional antivirus solutions struggle with LOTL attacks because they rely on identifying malicious files and signatures. Since LOTL attacks use legitimate tools, behavioral analysis and advanced threat detection are more effective. LOTL techniques can be used to launch payloads or execute malicious scripts, but they often bypass traditional malware to avoid detection.

While living off the land is a technique, living off the land binaries (LOLBINs) are the actual tools that adversaries use. These are legitimate IT tools, such as CertUtil.exe, PowerShell.exe, Regasm.exe, and Rundll32.exe, which attackers can use to execute malicious scripts or download files while blending in with legitimate activity.

LOTL and fileless malware are interrelated aspects of modern tradecraft that are often used simultaneously. LOTL is a technique for using legitimate system tools to disguise malicious activity. It can often be used to trigger fileless malware, which is malicious code that runs primarily in memory or abuses trusted system components, reducing obvious files on disk.

For example, a user accidentally runs a malicious macro in a document. The macro spawns Windows PowerShell (this is LOTL). PowerShell reaches out to the internet, grabs a payload (fileless malware), and injects it directly into the computer’s memory, where it runs malicious processes undetected by traditional antivirus.

PowerShell is frequently cited as the most abused legitimate tool due to its powerful capabilities for system administration, network access, and script execution.

No, LOTL attacks affect all operating systems. Linux and Unix systems face similar threats through abuse of built-in utilities, though the specific tools and techniques may differ.

Small businesses should focus on basic security hygiene: enable comprehensive logging, restrict administrative tool access, implement user training, and consider managed security services that specialize in behavioral threat detection.

Additional Resources

Protect What Matters

Secure endpoints, email, and employees with the power of our 24/7 SOC. Try Huntress for free and deploy in minutes to start fighting threats.
Try Huntress for Free