Security Operations · Intermediate

Living off the Land (LotL)

An attacker technique of using tools already present on the target system to blend in and avoid detection.

Definition

LotL attacks rely on built-in utilities such as PowerShell, WMI, certutil, PsExec and remote management tools rather than custom malware. Because these tools are legitimate, allowlisting and signature detection rarely block them. Detection focuses on unusual parent-child processes, command-line arguments and context.

Related terms