Living off the Land in penetration testing

At DeepBlue Security & Intelligence, penetration testing is part of our daily work. Our specialists simulate realistic attacks without being detected, often successfully. A standard technique is Living off the Land (LotL): abusing existing, legitimate tools instead of introducing external malware. Because these tools are already present in the operating system, antivirus and endpoint security have much more difficulty detecting their use. That invisibility makes the technique attractive to both penetration testers and real attackers.

Explanation

With LotL, an attacker or penetration tester uses trusted components already present in an environment to gain access, move laterally or exfiltrate data. These tools are known as LOLBins, supplemented by LOLScripts and LOLLibs. Examples include certutil.exe, which can download files and decode base64, and powershell.exe, which provides direct access to the .NET framework. On Linux, curl and wget can retrieve payloads or execute shell commands. No external malware is required to trigger conventional alarms.

Risk

Because these tools are legitimate and used in day-to-day administration, antivirus, EDR and network monitoring often trust them. Signature-based detection therefore falls short, while the technique can easily be combined with credential dumping or privilege escalation. A typical attack path starts with PowerShell, followed by a downloaded payload, command-and-control traffic, lateral movement through WMIC or PsExec and exfiltration through a trusted channel. Detection must shift from malicious files to malicious behaviour.

Points to check

• Legitimate system tools that fall outside standard detection.
• Insufficient logging of commands and script activity.
• No baseline for normal behaviour, allowing anomalies to go unnoticed.
• Excessive privileges that let standard users administer critical systems.

Approach

Log command activity with Sysmon or AuditD, restrict permitted binaries with AppLocker or WDAC and create SIEM rules for anomalous use of tools such as certutil.exe and powershell.exe. Tune EDR to the organisation and apply least privilege. Establish a clear baseline of normal activity so suspicious use of legitimate tools stands out. A mature SOC maps behaviour to MITRE ATT&CK and uses threat hunting and retrospective analysis.

Conclusion

Living off the Land is a powerful, stealthy technique used in almost every professional attack. Understanding which tools are present and how they are normally used, limiting functionality to what is strictly necessary and investigating anomalies strengthens defence. An active, well-tuned SOC with behavioural analytics is one of the most effective countermeasures.

Contact

Want to understand the impact in your own environment? Contact DeepBlue Security & Intelligence at info@deepbluesecurity.nl or +31 (0) 70 290 6 290.