What is Living-off-the-Land (LOTL)?

The security community calls these dual-use binaries LOLBins (Living-Off-the-Land Binaries), and the LOLBAS project maintains a public catalog of the ones Windows attackers abuse most. A few patterns show up constantly in real incidents: certutil.exe -urlcache -split -f used to download a second-stage payload instead of a browser, since certutil is meant for certificate management but happily fetches arbitrary URLs; mshta.exe executing a remote HTA file to run script code without dropping an executable; regsvr32.exe loading a remote scriptlet, a technique nicknamed Squiblydoo because it evades application allowlisting by abusing a signed Microsoft binary; and wmic.exe or PowerShell's Invoke-WmiMethod used to spawn processes on a remote host during lateral movement, since WMI is a standard remote-administration channel that rarely gets blocked outright. PowerShell itself is the most common LOTL vector of all: a base64-encoded command passed via -EncodedCommand, or a script that loads entirely into memory and never touches disk, defeats file-based antivirus scanning by design.

What makes LOTL attractive to an attacker is precisely what makes it hard to detect. There is no malicious file to fingerprint, the binary is digitally signed by Microsoft or another trusted vendor, and the same tool ran on that same host yesterday for a legitimate patching or inventory task. Endpoint protection that alerts on unknown executables has nothing to flag. MITRE ATT&CK captures this as a technique family rather than a single entry: T1218 System Binary Proxy Execution, T1059 Command and Scripting Interpreter, and T1047 Windows Management Instrumentation all describe variations on the same core idea of hijacking trusted functionality for malicious ends.

Detection has to shift from signature matching to behavioral context, since the tool itself is never the tell. What matters is the parent-child relationship (a Word document spawning certutil is a red flag; a scheduled task spawning certutil at 2am on patch night is normal), the command-line arguments passed to the binary, and whether the invocation deviates from that host's or that admin's established baseline. This is why LOTL detection depends heavily on rich process telemetry rather than antivirus alone.