Living Off the Land: Why Attackers Prefer Your Own Windows Tools

There is no malware in a living off the land intrusion. No implant, no dropper, no new file for antivirus to recognise. The intruder signs in with a working password and runs the same programs your administrators run all day, every one written and signed by Microsoft, and on the disk long before anyone attacked anything. CrowdStrike counted 82 percent of its detections in 2025 as malware-free, up from 51 percent in 2020.

That is what makes the technique worth understanding properly, because the defence it defeats is the one most organisations already bought. Endpoint tooling decides whether a file is malicious. Application control decides whether a binary is trusted. Living off the land hands both the correct answer to the wrong question: the file is not malicious, the binary is trusted, and the intrusion proceeds.

This is a technical breakdown for defenders and analysts, and every figure in it carries the population its source measured, because this is a subject where the numbers fall apart under inspection. It describes what each binary can do rather than reproducing commands, since the goal is recognising this activity. Let me walk through how the technique works, dissect two documented intrusions, and separate what the evidence supports from what gets claimed on top of it.

The living off the land chain. Only the credentials at the top change between intrusions, because the tooling underneath already belongs to the victim.

What Living Off the Land Means, and Why Attackers Choose It

Living off the land is the abuse of software that is already installed, already signed, and already trusted, and the last word does the work.

The definition worth using is the one ten government agencies signed. On 7 February 2024, CISA, the NSA, the FBI and seven partner agencies published joint guidance on identifying and mitigating living off the land techniques, which defines it as the abuse of native tools and processes, especially the binaries known as LOLBins, to blend in with normal system activity and operate with a lower likelihood of being detected or blocked, because those tools are already deployed and trusted in the environment. Two and a half years later that document has never been revised.

Read the causal clause again, because most published explanations skip it. The tools are not chosen for being obscure. They are chosen for being pre-approved, and pre-approval is a property of your environment.

The surface is also wider than a list of Windows binaries. The same guidance extends it to administrative software installed for legitimate reasons, remote monitoring platforms, endpoint configuration tooling, patch management, and the detection and response product itself, because those systems hold high privilege by necessity and can run commands on every client they manage. Your security stack is part of the attack surface it defends.

Figure 1: The attacker brings nothing to the job. Living off the land means reaching for a capability that the organisation installed, signed off, and depends on for daily administration, which is why the resulting activity has no malicious file for antivirus to examine and no unfamiliar process for an analyst to notice in a list.

MITRE tracks the core of this behaviour as System Binary Proxy Execution, technique T1218, and the entry states the economics without decoration: binaries signed with trusted digital certificates can typically execute on Windows systems protected by digital signature validation. One detail matters for anyone updating old material. ATT&CK v19, released on 28 April 2026, split the Defense Evasion tactic into Stealth and Defense Impairment, and T1218 now sits under Stealth. Every diagram still filing it under Defense Evasion is stale.

The attacker does not defeat your trust model. The attacker inherits it.

The Anatomy of an Intrusion That Brings No Malware

Strip out the actor names and the same six stages appear, and only the first needs anything the victim did not own.

It begins with valid access, a working credential or an unpatched service, the one part that resembles a conventional attack. Discovery follows, using shipped commands to enumerate hosts, users and domain trusts, then credential access, the stage where a defender expects a dumped tool on disk and where signed system libraries do the work instead. Lateral movement runs over remote desktop and the management interfaces as an account that genuinely exists, and impact destroys recovery with the platform's own shadow copy tooling.

Figure 2: The record a defender needs is the one Windows already produces, with one policy switched on. Parent process, full path, the OriginalFileName from the header, the account, and above all the command line: without that last field an entry says only that a trusted binary ran, never what it was asked to do. Illustrative recreation, not a screenshot.

Every stage above lands in an ordinary process creation record, which is where the leverage sits. The chain is the durable part: binaries move in and out of fashion, and the brand at the end is whichever affiliate bought the access. The sequence stays put, so detection built on it survives churn that detection built on file names does not.

Now let me show you two documented intrusions that ran it.

Campaign 1: Volt Typhoon and Five Years Inside Critical Infrastructure

The state-sponsored case is documented in the most detail, and its value is that almost nothing in it looks like an attack.

In the companion advisory published the same day, CISA, the NSA and the FBI confirmed compromises across four critical infrastructure sectors: Communications, Energy, Transportation Systems, and Water and Wastewater Systems. Keep the advisory's two claims apart, because they carry different weight. The compromises are confirmed. The intent is an assessment: the US authoring agencies assess with high confidence that the actors are pre-positioning to enable lateral movement to operational technology assets in order to disrupt functions. Their Canadian, Australian and New Zealand partners hedged more weakly still.

The tradecraft is the point. The advisory states that the actors rarely use malware for post-compromise execution and instead work hands on keyboard through the command line and other native tools, using the term LOLBins explicitly. It then enumerates twenty native tools and commands used for discovery alone, every one shipped with Windows.

Two details show how far that goes. The actors used netsh, which the advisory itself calls a legitimate Windows command, to write a port proxy configuration that turned a monitoring server into a proxy for their command and control traffic. In another they placed an outdated copy of comsvcs.dll, a Microsoft library that normally lives in the system folder, into a non-standard directory and used it to dump the memory of the process holding Windows credentials. The credential theft tool was Microsoft's own, and the only anomalies were its version and location.

Persistence followed the same logic. In a water and wastewater entity the actors moved laterally over nine months to a file server, a domain controller, an Oracle Management Server and a VMware vCenter server, and in one compromise the agencies say they likely extracted the domain credential database from three domain controllers across four years. That is the mechanism behind the headline: the agencies reported observing indications of access maintained in some victim environments for at least five years. Note every hedge there, because the figure is usually quoted without them.

Figure 3: Pre-positioning does not look like an attack in progress. The agencies describe access maintained in some victim environments for at least five years, held with valid accounts and tooling that was already installed, which produces an intrusion whose defining characteristic is that nothing appears broken, nothing is encrypted, and no ransom note arrives to tell anyone the room is occupied.

Password rotation does not evict an intruder who re-copies the credential database on a schedule.

Campaign 2: Akira and the Ransomware Crew That Travels Light

Criminal operations reached the same conclusion for commercial reasons, and the advisory for one of them names the technique outright.

The joint advisory on Akira, updated on 13 November 2025 by the FBI, CISA, the Defense Cyber Crime Center and European partners including Europol, states that the actors use PowerShell to execute scripts and Living Off the Land Binary commands for execution, persistence, credential harvesting, lateral movement, and disabling security controls to evade detection. One sentence, five kill chain functions, all performed with software the victim licensed.

The detail underneath is consistent. The advisory maps the Windows command shell to execution, persistence, lateral movement and the manipulation of security controls, and records the actors using PowerShell and the Windows Management Instrumentation command line to disable services. Domain controller and domain trust enumeration use the built-in net commands. Before encryption, the encryptor calls PowerShell to delete Volume Shadow Copy Service copies, so the victim's own recovery subsystem removes the victim's recovery options.

Figure 4: Signature validation answers a narrow question. It establishes that a binary came from the publisher it claims, not that the operation the binary is performing was requested by anyone legitimate. Microsoft maintains a published list of its own signed applications that can defeat application control for exactly this reason, and the list is explicitly never finished.

The commercial logic is straightforward. An affiliate using shipped tooling needs no development budget, leaves no sample for a vendor to sign, and inherits whatever exclusions the victim's administrators already carved out. The economics of the ransomware-as-a-service model reward that. Sophos, drawing on 661 incident response and managed detection cases handled between 1 November 2024 and 31 October 2025, found Cobalt Strike barely cracking its top 35 tools.

The famous offensive framework is losing ground to the tools already on the box.

Why a Signed Microsoft Binary Walks Past Application Control

The mechanism nobody explains is the one that decides whether your controls apply at all, and Microsoft documents it more honestly than most vendors do.

Microsoft publishes a list of applications that can bypass App Control, telling organisations to block its own signed script hosts, build engines, debuggers and the PowerShell engine library. The reason given defines the technique from the vendor's side: certain software applications may allow other code to run by design, and an attacker can use them to circumvent application allow policies. The list is explicitly unfinished.

Then there is the perimeter of the control itself. Microsoft's script enforcement documentation states that App Control does not directly control code run through the Windows command processor, batch files included. A PowerShell script that policy does not allow is not blocked, it is downgraded to Constrained Language Mode and keeps running. Allowing an unenlightened script host, a third-party Python or Java engine among them, implicitly allows every script that host will ever run. The joint guidance adds the field observation: CISA red teams often find these binaries reachable by every user account.

Application control is a real control with a documented perimeter. Attackers work on the far side of it, in daylight.

Two SOCs, One Red Team, and a Twenty Minute Difference

The best evidence that this is an operational problem rather than a technological one arrived six days before publication.

On 25 August 2026, CISA published A Tale of Two SOCs, describing two simultaneous red team assessments run with similar tradecraft against two organisations. Both were compromised to domain level, and one never noticed. The other caught it off a single medium severity alert stating that an executable file had loaded an unexpected DLL file, isolated three workstations within ten, two and twenty minutes, and forced the red team into an assume-breach arrangement.

The organisation that missed it was not blind. Its tooling did alert on the red team activity, and CISA's explanation is that thousands of false positives corresponding to normal business operations, many at higher severity, obscured those alerts. The contributing causes named are organisational: several operations centres whose staff had no visibility into each other's tools, and no procedure for escalating an alert.

Figure 5: Severity is assigned by the product, relevance by whoever knows what normal looks like on that estate. In the CISA assessments the row that mattered was rated medium and sat under louder, higher rated alerts describing ordinary business operations, which is why tuning decides whether an intrusion is seen at all. Illustrative recreation, not a screenshot.

CISA's summary of the difference is worth keeping on a wall: detection tools are only as effective as the people, processes, and procedures supporting them.

Same tradecraft, two outcomes, and the variable was not the product.

What the Malware Free Numbers Do Not Say

The statistic everyone quotes for this technique is real, and it does not mean what it is usually made to mean.

CrowdStrike reports that 82 percent of its detections in 2025 were malware-free, against 51 percent in 2020. Read the noun. A detection is a sensor event inside one vendor's telemetry, not a breach, and the report defines neither the term nor a denominator. CrowdStrike's own explanation of the figure names valid credentials, trusted identity flows and approved SaaS integrations, which is a statement about identity and cloud more than about Windows binaries.

Figure 6: A vendor detection share and a breach share are different instruments pointed at different things, and the most quoted number in this subject is a detection share. Naming the population in the sentence that carries a figure is not pedantry for a threat intelligence team, it is the difference between an assessment a reader can act on and one that quietly overstates its own reach.

Set it beside a breach dataset and the picture changes shape. Verizon's 2026 Data Breach Investigations Report, built from more than 22,000 confirmed breaches and covering October 2024 through November 2025, found ransomware present in 48 percent of all breaches, up from 44 percent. Ransomware is malware. In the same Verizon dataset, exploitation of vulnerabilities became the most common initial access vector at 31 percent, while credential abuse, the mechanism behind the phrase about attackers logging in rather than breaking in, fell to 13.

The prevalence numbers deserve the same care. Red Canary ingested 305 petabytes of telemetry from 1,700 organisations in 2025 and confirmed 110,000 threats, of which 34,000 were higher severity, and the rankings come from that smaller set. In them PowerShell placed second, affecting 19.6 percent of Red Canary customers across 1,054 threats, and the Windows command shell placed third at 15 percent. Those are the highest ranked native execution techniques in the public data, and they also mean four in five of that vendor's customers saw no confirmed PowerShell abuse in a year.

So the defensible thesis is narrower than the marketing version, and more useful. Living off the land is a durable post-compromise behaviour that raises the cost of triage, in an environment where intruders mostly get in through unpatched software and stolen identity, and where malware remains abundant. It is not a wave that replaced malware. It is what competent intruders do once the door is open.

How to Defend Against Living Off the Land

Because the technique runs on approved software under authorised identities, defence is a telemetry problem before it is a blocking problem.

The highest value measures are well established, and the order matters:

• Turn on command line capture before buying anything. Both policies are off by default, which is why so many teams collect process events with an empty command line field.
• Send the logs somewhere the intruder cannot reach. The first of the guidance's five prioritised detection practices is logging aggregated in an out-of-band, write-once read-many location, so administrative rights cannot buy an edited record.
• Baseline the small, stable set of binaries attackers actually use. Only two of the top thirty abused Microsoft binaries changed year on year in the Sophos casework, so the attacker's toolkit is knowable and your normal is the variable.
• Allowlist, then instrument what allowlisting cannot cover. Allowlisting with monitoring of common LOLBins is the second of the guidance's four hardening practices, and Microsoft names where it stops: the command processor, unenlightened script hosts, and downgraded PowerShell.
• Hunt sequences and provenance, not names. The guidance states there is rarely a single indicator of this activity, and for renamed utilities it sends defenders to the OriginalFileName field rather than the name on disk.

One rule underneath all of that is worth teaching until it is reflexive:

Every binary Microsoft ships is a tool your attacker already has, already signed, and already permitted to run.

Reinforce it with the habits: decide which administrative tools your estate needs, instrument the ones you cannot remove, and treat an exclusion request as a detection decision rather than a ticket. Sophos makes the asymmetry concrete, arguing that PowerShell has to be instrumented because it cannot be removed, while Python should generally be blocked unless the organisation needs it.

The Signals That Separate Abuse From Administration

There is no indicator list for this technique, and pretending otherwise is the most common failure in published guidance.

The reason is structural. In a conventional intrusion the artefact and the legitimate tool are different objects, so a hash separates them. Here they are the same object, which is why the joint advisories warn that some published hashes belong to legitimate tools. What follows is a table of behaviours, not a block list.

Every row above is a question about context rather than content, which is the same reason ClickFix is hard to catch at the moment of execution: the machine sees an authorised human doing something authorised humans do.

What This Means for CTI Analysts

For a threat intelligence function, the strategic point is that living off the land is a property of the victim's environment, not an attribute of an actor group. The two intrusions above share no infrastructure, no motive and no sponsor, and converge on the same handful of programs because those programs are on the box. That makes the durable intelligence product an inventory rather than a feed: which administrative tools exist in your estate, who may run each one, and which nobody has needed in a year. Answer that and an unbounded detection problem becomes a bounded one. Leave it unanswered and you keep buying products that report the intrusion into a queue nobody reads.

Figure 7: A baseline is the cheapest control in this article and the hardest to buy. Knowing which administrative tools run in your estate, on which hosts, under which accounts and at which hours turns an unbounded question about trusted software into a short list of exceptions, and that list is the deliverable a threat intelligence function can own.

This is exactly the kind of judgment CTI Academy's Hunter track builds through practice rather than memorization. Using Linux in Cyber Threat Analysis puts the command line in front of you, which is where an administrator's session and an intruder's have to be told apart, and Threat Intelligence Associate covers turning that observation into a product somebody acts on. Because so many of these intrusions begin with a credential, our LeakLens environment shows what happens to those credentials underground. Read the technique here, then go build the baseline. To start, explore the Hunter track.

Research current as of 2026-08-31. Figures reflect the reporting periods named alongside them.

Frequently Asked Questions

What is a living off the land attack?

A living off the land attack is an intrusion carried out with software already installed on the target, mainly the administrative tools and signed binaries that ship with the operating system. Ten Five Eyes agencies define it as abuse of native tools to blend in with normal system activity, because those tools are already trusted.

What are LOLBins?

LOLBins are living off the land binaries, the executables and libraries that ship with an operating system and can be made to do attacker-useful work such as downloading a file, executing code or copying a credential store. Because administrators use them legitimately, they carry trusted hashes and signatures that mislead defenders into allowing them everywhere.

What is the difference between living off the land and fileless malware?

Living off the land describes where the capability comes from, meaning software already present and trusted on the host. Fileless describes where code executes, usually in memory rather than from disk. The two overlap constantly but are not the same claim, and Microsoft notes that no single definition of fileless exists across the industry.

Why is living off the land so hard to detect?

Because the tool and the authorised administrative tool are the same object, so hashes and file names cannot separate them. The Five Eyes guidance notes a general lack of conventional indicators, says there is rarely a single indicator of the activity, and states plainly that no foolproof solution fully prevents or detects it.

Which Windows tools do attackers abuse most?

Public data points at the shipped interpreters and management interfaces. Red Canary ranked PowerShell second and the Windows command shell third among all techniques in 2025. The Volt Typhoon advisory lists twenty native discovery commands, and Sophos found only two of its top thirty abused Microsoft binaries changed year on year.

Can application allowlisting stop living off the land attacks?

Partly. Microsoft maintains a published list of its own signed applications that can bypass App Control precisely because some applications run other code by design. Its documentation also states that App Control does not directly control the Windows command processor, and that disallowed PowerShell scripts are downgraded to Constrained Language Mode rather than blocked.

How common are living off the land attacks in 2026?

Common enough to be routine, though the popular figure is misread. CrowdStrike reports 82 percent of its detections in 2025 as malware-free, which counts sensor events rather than breaches. Verizon, measuring confirmed breaches instead, still found ransomware in 48 percent of them, so malware has not disappeared.

Sources

• CISA, NSA, FBI and partners, JOINT GUIDANCE: Identifying and Mitigating Living Off the Land Techniques and PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure
• CISA, A Tale of Two SOCs: Insights From Two Red Team Assessments
• FBI, CISA and partners, #StopRansomware: Akira Ransomware
• MITRE, System Binary Proxy Execution (T1218), ATT&CK v19
• Microsoft, Applications that can bypass App Control and how to block them and App Control for Business script enforcement
• CrowdStrike, CrowdStrike 2026 Global Threat Report
• Red Canary, 2026 Threat Detection Report, PowerShell
• Sophos X-Ops, Nowhere, man: The 2026 Active Adversary Report
• Verizon Business, 2026 Data Breach Investigations Report, executive summary