Living off the Land attacks pose a pernicious threat for enterprises

Living off the Land attacks have become one of the most persistent and difficult threats facing enterprise security teams. Unlike traditional intrusions that rely on custom malware or obvious exploits, these attacks weaponize the tools organizations already trust and depend on every day. PowerShell, Windows Management Instrumentation, PsExec, scheduled tasks, bash scripts and other native utilities become part of the attack surface. These attacks succeed not because defenders lack tools, but because defenders still assume that legitimate activity is inherently safe. 

This approach allows adversaries to blend seamlessly into normal operations. Instead of triggering alerts tied to malicious binaries or known signatures, Living off the Land techniques exploit legitimate administrative functionality to move laterally, escalate privileges and quietly exfiltrate data. From the attacker’s perspective, the goal is simple: operate within the environment’s rules rather than break them.

As enterprises expand their use of cloud services, automation frameworks and hybrid architectures, the reliance on native system tools continues to grow. The same capabilities that enable scale, resilience and efficiency also create ideal conditions for stealthy intrusions. Recent threat intelligence reports show that a majority of modern attacks now incorporate Living off the Land techniques, underscoring how quickly this tradecraft has become the norm rather than the exception.

For CIOs, the concern is not just that these attacks are hard to detect. It is that they exploit the very mechanisms used to keep systems running. Whether managing critical communications infrastructure at a federal agency (which one of us did as CIO of the FCC for 4 years) or overseeing enterprise IT operations, the tension remains constant: Administrative tools are simultaneously essential for operations and attractive targets for adversaries. Blocking these tools outright is rarely an option without disrupting critical business functions. The result is increased dwell time, higher remediation costs, reduced visibility into attacker intent and a steady erosion of trust in traditional security controls.

High-profile Advanced Persistent Threat (APT) actors such as Salt Typhoon illustrate how sophisticated adversaries can conduct long-running operations using little more than system native capabilities. With sufficient knowledge of enterprise environments, attackers can persist for months while appearing indistinguishable from legitimate administrators.

Evan recently observed a Living off the Land incident at a major telecommunications provider that highlights this challenge. Security rules initially blocked a set of IP addresses believed to be malicious. Those addresses turned out to be valid customer premise equipment. Disabling them degraded customer performance and created operational risk, while the attacker activity continued elsewhere using legitimate tooling. This kind of misalignment between security signals and business reality is increasingly common because of Living off the Land scenarios.

Organizations most at risk from Living off the Land attacks

Every enterprise is vulnerable to Living off the Land attacks because the techniques rely on standard operating system functionality rather than specialized software. That said, organizations that operate complex, distributed or mission-critical environments face disproportionately higher risk.

Critical infrastructure providers such as utilities, telecommunications networks and transportation systems are especially exposed. These environments often include devices that haven’t been patched or updated in years and can lack even basic controls that we take for granted today. They depend heavily on high-privilege administrative tools to manage uptime, safety and regulatory compliance. The geopolitical implications are significant: Adversaries targeting critical infrastructure increasingly use Living off the Land techniques precisely because they understand that defenders cannot simply disable the tools that keep essential services running. Financial institutions face similar exposure across trading platforms, payments infrastructure and identity systems where automation and remote management are deeply embedded.

Hybrid environments further expand the attack surface by increasing the number of endpoints, identities and trust relationships attackers can exploit. The more administrative paths that exist between systems, the easier it becomes for adversaries to mimic expected behavior while advancing their objectives. The growing use of general-purpose GenAI and jailbroken (WormGPT) large language models by attackers compounds the problem. Automation scripts that once required deep technical expertise can now be generated, modified and adapted quickly. This lowers the barrier to entry and accelerates the spread of Living off the Land techniques across a broader range of threat actors.

Ultimately, any organization that relies heavily on PowerShell, WMI or similar orchestration frameworks must assume that these tools will be targeted. The question is no longer whether Living off the Land techniques will be used, but whether the organization can identify malicious intent before meaningful damage occurs.

Best practices for combatting Living off the Land attacks

Hardening native system tools without breaking operations

The first step in addressing Living off the Land risk is hardening the system tools most commonly abused by attackers. This requires a careful balance. These tools are essential for IT operations, so controls must reduce abuse without undermining legitimate use.

Effective hardening begins with tightening how and when administrative tools can be executed. Constraining scripting environments, enforcing signed scripts, reducing unnecessary functionality and applying least privilege access principles all limit the opportunities available to attackers. Many organizations discover that privileges have accumulated over time in ways that no longer align with current operational needs. Hardening also includes disciplined configuration management. Attackers frequently exploit misconfigurations rather than software vulnerabilities. Regular audits of system settings, administrative permissions and automation workflows can eliminate gaps that quietly expand the attack surface.

However, CIOs should be clear-eyed about the limits of hardening. These measures reduce exposure but do not prove intent. A well-configured PowerShell environment can still be misused by a compromised credential or a malicious insider. Hardening raises the bar for accessing systems. But if a bad actor cracks a login, having advanced controls in place doesn’t really do much to reduce the havoc they can wreak. 

Continuous monitoring that understands behavior

Continuous monitoring is essential for fighting Living off the Land activity. Uncovering context is huge here. What matters in Living off the Land scenarios is understanding how and why a tool is being used. A PowerShell command executed by the right account at the wrong time or in the wrong sequence may be far more significant than an obviously unusual event that lacks context.

SOC teams need consolidated visibility across administrative tools, identities, systems and timing. Is a script being executed outside normal maintenance windows? Is a privileged account accessing systems it rarely touches? Are administrative actions chaining together in ways that suggest lateral movement rather than routine management? Context transforms noise into signal. Without it, security teams are flooded with alerts that reflect operational complexity rather than attacker intent. This leads to alert fatigue and missed opportunities to identify early-stage intrusions.

Continuous monitoring must also account for the reality of hybrid environments. Visibility gaps between cloud services and on-premises systems create blind spots attackers are quick to exploit. Unified telemetry that spans these domains is critical to understanding how activity in one area influences risk in another.

Giving SOC teams the time and mandate to hunt proactively

Even with strong hardening and continuous monitoring, Living off the Land attacks often evade purely reactive defenses. Their subtlety requires proactive hunting by skilled analysts who understand attacker tradecraft and business context. SOC teams are frequently overwhelmed by routine operational alerts, compliance reporting and administrative overhead. When every hour is consumed by triage, there is little capacity left to search for the faint signals that indicate an emerging Living off the Land intrusion.

Effective hunting focuses on intent rather than anomalies. Analysts look for patterns that suggest goal-oriented behavior, such as repeated credential use across systems, subtle privilege escalation or administrative actions that create future access rather than immediate impact. This work requires deep familiarity with how the business actually operates. Analysts must understand which workflows are normal, which are rare and which should never occur. That knowledge cannot be encoded entirely in rules or automated systems.

Overall, the most resilient organizations are those that empower SOC teams to think like adversaries while staying grounded in operational reality. This changes detection from a reactive effort into a form of continuous validation that systems are behaving as intended.

Adapting security strategy to a Living off the Land world

Living off the Land attacks represent a long-term evolution in how adversaries operate. As defenses improve, attackers increasingly choose the path of least resistance by abusing trusted tools rather than introducing foreign code. This shift demands a corresponding evolution in security strategy. Perimeter-centric models are no longer sufficient on their own. Enterprises must assume that some level of compromise is inevitable and focus on reducing dwell time and limiting impact.

Adapting to this reality requires shifting focus from tools to behavior and from individual events to intent over time. Hardening reduces exposure, but it does not explain why actions are occurring or how they connect. What matters is the sequence of events, their timing and the context across identities and environments.

In a Living off the Land world, zero trust must be extended beyond authentication events and enforcement points. The path forward is not chasing every new tool or threat, but understanding how attackers operate, how systems are actually used and how security can align with real business operations. As environments grow more complex, no human analyst can reason about every possible behavior in isolation. Security strategies must evolve to recognize intent at scale, or risk falling behind attacks designed to hide in plain sight.

This article is published as part of the Foundry Expert Contributor Network.
Want to join?