Living Off The Land (LOTL).

What is living off the land?

CISA and its partners describe living off the land (LOTL) as cyber activity that uses existing system tools and legitimate applications rather than deploying custom malware. In its advisory on one state-sponsored actor, CISA describes the use of native tools and processes already on systems, such as the command line, PowerShell and similar built-in utilities.

How does it work?

The attacker first gains access to a network. After that, the attacker uses what is already installed, so no new malicious program needs to be placed on the machine. CISA says this approach keeps the attacker’s cost low while remaining effective. The advisory says this lets the actor blend in with normal system and network behavior, and it describes the actor’s aim as maintaining persistence.

Why does it matter?

CISA says many organizations lack security practices that support the detection of LOTL activity. It also says network defense weaknesses make it hard for administrators to tell malicious actions from routine behavior, even in organizations with mature security programs. Tools that administrators use every day are not suspicious by themselves, so searching for known malicious files may be less useful on its own.

How can you detect it?

The CISA advisory points to checks on behavior and logs rather than on files alone.

• Review logs for signs of credential theft, such as particular database events that CISA lists for the Windows directory database.
• Examine VPN and logon patterns for impossible travel, meaning sign-ins from far apart places within a short time, and for unusual session length or frequency.
• Look in temporary and public folders for unexpected files,.
• Enable comprehensive logging, such as application, security and access logs, and keep it in a central place such as a SIEM.

How can you reduce the risk?

CISA’s recommended mitigations include the following.

• Apply patches to internet-facing systems, and prioritize known exploited vulnerabilities.
• Use phishing-resistant multi-factor authentication for access to assets.
• Keep good credential hygiene, for example by not storing passwords in plain text.
• Segment networks, including keeping operational technology apart from IT.
• Disable legacy authentication protocols in cloud and hybrid environments.

Is living off the land the same as using malware?

No. The point of LOTL is that the attacker relies on legitimate tools instead of custom malware. The attacker may still use other methods to get in, but the actions inside the network come from tools that are already present.

Does LOTL mean that the tools themselves are bad?

No. The tools are legitimate and administrators rely on them. The risk comes from how an attacker uses them, which is why it can help to look at who runs a tool, where, when and how often.

Related pages in the Knowledge Hub

• Volt Typhoon

Sources

• CISA: LOTL uses existing tools and legitimate applications rather than custom malware; low investment, effective; defenders lack detection capabilities and struggle to….
• CISA: Native tools such as PowerShell used to persist and evade detection; detection checks (logs, impossible travel, temp folders) and mitigations (patching,….