Living off the Land
Living off the Land (LotL)
Living off the Land (Leben vom Land)
Living off the Land denotes an attack technique in which the attackers bring no malware of their own but misuse the already present, legitimate on-board tools of the system — such as administration tools and scripting languages of the operating system. They thus disguise themselves as normal operation. This is precisely what makes them so hard to grasp for classic antivirus solutions.
History & facts. Instead of dropping a recognisable malicious file, attackers use existing, signed system tools (often called „LOLBins“) and scripting environments to execute commands, collect data or move on. Frequently this happens filelessly, i.e. only in memory, without a permanent trace on the data carrier. The advantage for the attackers: antivirus that searches for known malicious files does not trigger, because the tools used are legitimate and desired. This technique is today an integral part of many attacks — from lateral movement to the preparation of ransomware.
Outlook & recommendation. Because legitimate means are misused here, the question „Is this file malicious?“ does not help, but rather „Is this behaviour normal in this context?“. What is needed is therefore behaviour detection, precise logging of command execution and script activity and — because much happens only in memory — memory forensics (see Volatility, Memory Dump). It is also helpful to restrict powerful on-board tools and to monitor their use closely. Living off the Land is a prime example of why modern detection must move from the file to the behaviour.