The most sophisticated attackers don't bring their own malware — they use the tools already installed on your computers. PowerShell, WMI, certutil, and other legitimate Windows utilities are repurposed to run malicious code, move laterally, and exfiltrate data — all while appearing as normal system activity.
"Living off the land" (LotL) is a term for attack techniques that use operating system tools and features already present on a target system, rather than introducing new malware. The name comes from the military strategy of using local resources rather than bringing supplies — here, the attacker uses your tools rather than bringing their own.
This approach has become dominant among advanced threat actors precisely because it's harder to detect. Signature-based antivirus looks for known malicious files. If the attacker never introduces a new file — instead using PowerShell to run malicious commands directly in memory — there's nothing for the antivirus to detect.
The Most Commonly Abused Windows Tools
PowerShell: Microsoft's powerful scripting language, built into every modern Windows system, is the most frequently abused legitimate tool in attacks. Attackers use PowerShell to: download additional payloads from the internet, execute code entirely in memory without touching disk, modify registry settings, exfiltrate data, and disable security software. PowerShell is so central to attackers' toolkits that Microsoft has added extensive logging and script block logging to help detect abuse.
WMI (Windows Management Instrumentation): WMI allows remote management of Windows systems and is frequently used by attackers for lateral movement — moving from one compromised system to others on the network — and for persistence (scheduling malicious tasks to execute on system events).
certutil: A certificate utility tool commonly used by attackers to download files from the internet (using the -urlcache option) because it's a trusted system binary that many security tools don't flag.
mshta and regsvr32: Used to execute malicious scripts disguised as HTML applications or COM objects, bypassing application control policies that only whitelist known executable types.
The Attack Chain Example
A real LotL attack chain might look like this: A user opens a malicious Word document. The document's macro runs a PowerShell command that downloads a second-stage script from a legitimate cloud service (GitHub, Pastebin, Azure). The script runs entirely in memory, using WMI to move laterally to the server, where it uses scheduled tasks for persistence, and uses certutil to exfiltrate harvested credentials to an attacker-controlled domain. Every step used a legitimate Windows tool. No malware file was ever written to disk.
How EDR Detects LotL Attacks
Signature-based antivirus cannot detect this attack chain — there's no malicious file to match signatures against. EDR tools like SentinelOne detect behavioural anomalies: PowerShell spawning from an Office process is suspicious. PowerShell making outbound network connections to newly registered domains is suspicious. certutil downloading an executable is suspicious. EDR correlates these behavioural signals and identifies the attack pattern regardless of whether any individual component matches a known malicious signature.
Living off the land attacks are specifically designed to evade traditional antivirus. They're caught by behavioural detection — EDR tools that monitor what processes are doing, not just what they are. This is the core reason endpoint protection has moved beyond antivirus.
