Living off the land attack
Living off the land attack
(also live off the land attack, LOTL, LOL attack)
Living off the land attack definition
A living off the land attack is a cyberattack that exploits legitimate tools already present on a compromised system. By utilizing existing resources, hackers attempt to blend in with normal system behavior and evade detection.
See also: advanced evasion technique, cyberattack, heuristic analysis, lateral movement, privilege escalation
Common tools used in living off the land attacks
- PowerShell: In Windows systems, hackers can abuse PowerShell to download malware, establish command-and-control channels, scout the network, or escalate privileges.
- Windows Management Instrumentation (WMI): WMI allows system administrators to manage Windows resources. Hackers can abuse WMI to execute commands remotely, gather system information, identify users and groups, or execute malicious code.
- Command-Line Interfaces (CLI): CLIs (such as cmd.exe on Windows or Bash on Linux) allow users to directly interact with the operating system. Hackers can use CLIs to execute commands, navigate the system, and manipulate files and directories.
Stopping living off the land attacks
- Use application blocklists and allowlists. By restricting the execution of unauthorized scripts, you can minimize the risk of hackers compromising your system.
- Implement the principle of least privilege to limit access rights and prevent hackers from exploiting privilege escalation.
- Use heuristic analysis to identify anomalous behavior within the system, such as unusual tool usage or suspicious command-line activities.
- Educate users about the risks associated with living off the land attacks, especially the need for caution when using powerful administrative tools.
- Keep systems updated with the latest security patches to mitigate vulnerabilities that hackers may exploit.