Living-off-the-Land Attacks
Threat IntelligenceDefinition
Cyber attacks that use legitimate, built-in system tools to carry out malicious activities.
Technical Details
Living-off-the-Land (LotL) attacks leverage the existing tools and features of the operating system or application environments to execute malicious actions without the need for additional software installations. Attackers utilize scripts, commands, or built-in utilities that are already trusted by the system to evade detection by security solutions. Common tools include PowerShell on Windows, Bash scripts on Unix/Linux systems, and native programming languages like Python. These attacks often involve lateral movement within networks, data exfiltration, or establishing persistence while minimizing the footprint of the attack.
Practical Usage
In practical scenarios, attackers might gain initial access to a network through phishing or exploiting vulnerabilities. Once inside, they can use native tools such as Windows Management Instrumentation (WMI), PowerShell, or Task Scheduler to perform reconnaissance, move laterally, and execute payloads without raising alarms. Organizations can implement monitoring solutions that analyze the behavior of these legitimate tools to detect unusual patterns, such as unexpected command executions or file accesses, to mitigate the risk of LotL attacks.
Examples
- An attacker uses PowerShell to download and execute a malicious script that steals credentials from the system's memory.
- A compromised machine runs a scheduled task using Windows Task Scheduler to periodically exfiltrate sensitive data to an external server.
- An attacker employs WMI to gather information from other machines on the network, allowing for unauthorized access and data manipulation.