Living off the land (LOTL)
Also known as: LOTL, living-off-the-land attack, living off the land attack
Living off the land (LOTL) is an attack approach where hackers use legitimate tools already built into a system, such as PowerShell, Windows Management Instrumentation, or remote desktop, instead of installing their own malware.
Because these tools are used by administrators every day, malicious activity blends in with normal work. While LOTL makes attacks stealthier, careful logging and baselines of normal admin behaviour can still reveal it.
Living off the land (LOTL), explained at three levels
At home
Imagine a burglar who brings no tools and instead uses the ladder in your garage and the spare key on your hook. Nothing new appears in the house, so nothing looks out of place. Living off the land attacks work the same way: hackers use programs already built into your computer, which security software trusts, rather than installing malware it might catch.
At work
Living off the land is an attack style where hackers use legitimate tools already built into company systems, such as PowerShell or remote desktop, instead of installing their own malware. Because IT staff use those same tools every day, antivirus software rarely flags them and the activity blends in. Businesses catch it by logging how admin tools are used and spotting behaviour that doesn't fit normal work.
At home
Every Windows and Mac computer ships with powerful built-in tools for administrators: command lines, scripting languages and remote management features. Antivirus software trusts these tools because the system needs them. Attackers who get in use those same tools to explore the network, copy files and run commands, so there is no suspicious new program for a scanner to catch. The attack hides inside activity that looks like normal maintenance.
At work
Commonly abused Windows binaries include PowerShell, WMI, certutil, mshta, rundll32, bitsadmin and scheduled tasks, along with legitimate remote management software. The LOLBAS project documents which built-in programs can download, execute or hide code. Detection depends on visibility into behaviour: PowerShell script block logging, command-line process auditing, Sysmon and EDR telemetry that records parent and child processes. A certutil download from an Office macro is suspicious even though certutil itself is legitimate.
At home
While LOTL attacks sound frightening, they almost always follow a break-in through ordinary means, such as a phishing email or a reused password. The built-in tools only become dangerous once someone has a foothold. Targets are mostly businesses and government networks, where attackers want to stay hidden for months. In my view, home users get far more from updates, unique passwords and turning on MFA than from worrying about this technique.
At work
Government agencies including CISA and the Canadian Centre for Cyber Security warned in 2023 and 2024 that state actors such as Volt Typhoon used almost purely LOTL tradecraft against critical infrastructure. Defending against it means baselining normal administrative activity per host and user, then alerting on deviations. Application control such as WDAC, PowerShell Constrained Language Mode, attack surface reduction rules and removing unneeded tools shrink the toolkit. Centralized, long-retained logs matter because these intrusions are low-noise and often discovered long after initial access.
Real-world examples
At home
Carlos read about a hacking group that hid inside utility networks for months. Investigators said the attackers used only built-in Windows tools, so antivirus never flagged them.
At work
Lena is a security engineer at a Canadian water utility. After the Volt Typhoon advisories, she turned on detailed PowerShell logging and alerts for unusual use of admin tools outside maintenance windows.
How it compares
| feature | Living off the land (LOTL) | Malware-based attack |
|---|---|---|
| Tools used | Built-in system tools | Attacker's own software |
| Antivirus detection | Difficult | Easier |
| Evidence left | Logs, if enabled | Malicious files |
| Key defence | Logging and behaviour analysis | Endpoint protection |
LOTL hides in normal admin work. Detection depends on knowing what normal looks like.
For analysts
I'd confirm that detailed logging is turned on and kept for months, not days. LOTL attacks are often found long after they start, and only logs can show what happened.
History & origin
Security researchers Christopher Campbell and Matt Graeber popularized the phrase 'living off the land' in a talk at the DerbyCon security conference in 2013. The community project LOLBAS later catalogued Windows programs that attackers abuse, sometimes called 'LOLBins.' State-sponsored and criminal groups increasingly favoured these techniques to avoid antivirus detection. In May 2023, Microsoft and government agencies, including Canada's Cyber Centre, warned about Volt Typhoon, a China-linked group using living-off-the-land methods to quietly access critical infrastructure networks, with a further joint advisory in February 2024. In my view, LOTL shows that 'no malware found' is not the same as 'no attacker present.'