Attacks and malware
What is Living off the land?
Attacking with tools already built into the operating system, such as PowerShell or certutil, so that no obvious malware needs to be installed.
Living off the land means using tools that already exist on the target system, such as PowerShell, WMI, certutil, rundll32 or scheduled tasks, instead of bringing custom malware. These built-in programs are often called LOLBins.
The approach avoids antivirus signatures and blends in with normal administration. Detection depends on context: which user ran the tool, with what arguments, from which parent process and at what time.