Living Off The Land

What is Living Off The Land (LotL)?

Living Off The Land (LotL) is an attack technique in which an attacker brings in no malware of their own, but abuses the legitimate tools, scripts and management software already present on the victim’s systems and network. Because PowerShell, WMI, Remote Desktop and the site’s own engineering software are also used by administrators every day, the malicious use blends into normal behaviour and evades much of the detection. The term was coined in 2013 at the DerbyCon hacker conference by security researchers Christopher Campbell and Matt Graeber.

In OT environments, LotL is especially dangerous: systems often have weak Logging and Monitoring, administration tools sit on every engineering station, and the site’s own SCADA software can already operate the plant directly.

🧠 Why is LotL so hard to detect?

Classic security looks for something foreign: an unknown file, a known malware signature, a suspicious process. With LotL there is nothing foreign. The attacker runs powershell.exe, wmic.exe or ntdsutil.exe, which are signed by Microsoft and trusted by default by antivirus and even many EDR products.

The joint guidance Identifying and Mitigating Living Off the Land Techniques from CISA, the NSA, the FBI and the cyber agencies of the United Kingdom, Canada, Australia and New Zealand, among others (February 2024), concludes that many organisations, including mature ones, cannot tell legitimate from malicious use of these tools. The main causes are missing or insufficient logging and the lack of a baseline of normal behaviour.

⚙️ Which tools are abused most often?

The open LOLBAS project (Living Off The Land Binaries, Scripts and Libraries) maintains a catalogue of Windows programs that attackers can abuse, mapped to MITRE ATT&CK techniques. GTFOBins plays the same role for Linux and Unix.

Note that PsExec is not part of Windows but a free downloadable admin tool. Because many administrators and OT vendors use it, its abuse still attracts little attention.

🏭 What does LotL look like in OT environments?

In OT, LotL goes a step beyond Windows tools. The most powerful “built-in tool” there is the control software itself: SCADA servers, HMIs and engineering stations can by definition open valves, switch breakers and change PLC programs. In MITRE ATT&CK for ICS this falls under techniques such as Scripting (T0853) and System Binary Proxy Execution (T0894).

The best-known example of LotL in critical infrastructure is Volt Typhoon. This Chinese state-sponsored group embeds itself in the networks of energy, water, telecoms and transport companies, relying almost exclusively on PowerShell, WMI, netsh and ntdsutil. According to US advisory AA24-038A of 7 February 2024, the group had held undetected access to some networks for at least five years.

🛡️ Which measures help against LotL?

Because you cannot remove these tools without breaking administration, defence revolves around restricting, recording and recognising deviations.

🔧 How do you approach LotL detection in OT step by step?

1. Inventory - record which admin tools are needed on which systems. An engineering station may need PowerShell; an HMI client usually does not.
2. Harden - remove or block unnecessary tools and services via Group Policy, disable the legacy PowerShell 2.0 engine and apply hardening baselines. Use Code Signing for your own scripts and keep up with patch management.
3. Record - ensure comprehensive logging with sufficient retention, stored centrally so that an attacker cannot wipe logs locally. The joint guidance Best practices for event logging and threat detection (August 2024) was written specifically for this.
4. Establish a baseline - OT networks are predictable: the same hosts talk to the same PLCs. That is exactly why a new RDP session at three in the morning or a first ntdsutil call stands out. Use anomaly detection to flag this automatically.
5. Hunt actively - threat hunting for known LotL patterns, such as encoded PowerShell commands (-EncodedCommand) or certutil with -urlcache.
6. Rehearse the response - include LotL scenarios in the incident response plan: which accounts do you block, and how do you keep the process running while you isolate an engineering station?

In the EU, NIS2 requires essential and important entities to take appropriate measures such as logging, detection and access control; in the Netherlands it has been transposed by the Cyberbeveiligingswet (Cybersecurity Act), in force since 15 August 2026. For OT, the requirements of IEC 62443 build on this, in particular for account management, event logging and restricting functionality to what is needed.

❓ Frequently asked questions

What does LotL stand for?

LotL stands for Living Off The Land. In a Living Off The Land attack, the attacker uses what is already present on the system, such as PowerShell, WMI and RDP, instead of bringing their own malware. Files suited to this purpose are also called LOLBins (Living Off The Land Binaries).

Why does antivirus not spot LotL attacks?

Antivirus mainly looks for known malicious files, and in Living Off The Land attacks every program used is legitimate and signed by Microsoft. Detection therefore has to look at behaviour and context: who starts a tool, with which parameters, at what time and from which system.

Can I not simply disable PowerShell?

Blocking PowerShell completely is possible on many systems, but admin tools and some OT software depend on it. A better approach is to limit PowerShell to the systems that really need it, enforce Constrained Language Mode and enable Script Block Logging, so that abuse of PowerShell becomes visible.

Is LotL only a Windows problem?

No, Living Off The Land also occurs on Linux, macOS, network devices and in cloud environments, where attackers abuse standard commands and management APIs. In OT, even the site’s own SCADA or engineering software can serve as a LotL tool, as Sandworm demonstrated with MicroSCADA in 2022.

Which threat actors use LotL?

Living Off The Land is used above all by state-sponsored groups such as Volt Typhoon and Sandworm, but also by ransomware gangs, which spread their malware across a network using PsExec, RDP and scheduled tasks. As a result, most targeted attacks include a LotL phase.

How do I start detecting LotL in an OT network?

Start with central logging of PowerShell, process creation and logon attempts on engineering stations, jump servers and domain controllers. Then establish a baseline of normal administrative behaviour, so that deviations such as night-time RDP sessions or new scheduled tasks stand out immediately.

📌 In summary

Living Off The Land attacks are difficult to detect because they install nothing “suspicious”, abusing the victim’s own admin tools and even its SCADA software instead. Especially in OT, restricted admin rights, comprehensive logging, a baseline of normal behaviour and awareness are needed to recognise abuse of built-in tools in time.