Living off the land means attackers use tools already on your systems, such as PowerShell or wmic, instead of dropping malware. There is no file to scan. You find it by looking at behavior: who ran what, from where, and whether it was normal. This checklist uses the details in the CISA Volt Typhoon advisory.
Why it works
CISA says the actors in that advisory relied mainly on built-in tools and valid accounts, which helps them evade detection. Signature-based antivirus has nothing to match. Every command is something an administrator could plausibly run.
Start with logging
You cannot hunt in logs you do not keep. The advisory recommends enabling and centralizing logs. Two items stand out because the actors did them on purpose: they selectively cleared Windows event logs, and they used volume shadow copies to extract the Active Directory database.
The checklist
- Alert on log clearing. CISA points to Windows Event ID 1102. A cleared security log on a server is rarely routine.
- Watch for Active Directory database copying. The advisory mentions ESENT events that may indicate NTDS.dit copying, and tools such as ntdsutil. Review who runs these.
- Review administrator logins. Look for admin accounts using RDP to hosts they have never touched.
- Look at the edge. Routers, VPNs and firewalls were the entry point. Check their configurations and logins, and check that credentials are not stored on them.
- Baseline built-in tools. Which accounts normally run PowerShell, wmic or netsh? A baseline turns "possible" into "unusual".
- Check for odd proxying. The advisory describes multi-hop proxies through small office routers and virtual servers. Unexpected outbound connections from an edge device deserve a look.
- Test OT boundaries. Confirm that IT to OT connections are denied by default and that the allowed ones go through a monitored intermediary.
What a small team can realistically do
You do not need a full detection team. Pick three items from the list and make them an alert or a weekly review. Log clearing and new admin logins are the cheapest. Write down who is allowed to run the sensitive commands.
If you find something, CISA's advice is to assume full domain compromise, rotate credentials, audit network device configurations, and report to the relevant agency. Do not clean up one host and call it done.
Make the hunt repeatable
One-off hunts fade. Turn each finding into a standing rule. If you discover that an admin account ran ntdsutil outside a change window, write an alert for it. If you find a router login from an unfamiliar address, add that to the edge device review. Keep a short log of what you looked for, what you found and what you changed, so the next person starts from your notes.
Also check that your logging survives an attacker's attention. The advisory notes that the actors selectively cleared event logs, so forward logs off the machine quickly. A log that exists only on the host it describes is easy to lose.
Quick check
Is living off the land the same as fileless malware?
Not exactly. The term in the advisory means using legitimate built-in tools and valid accounts. Some attacks also use no files, but the defining feature is the use of trusted tools.
Which single log event does CISA call out for log clearing?
Windows Event ID 1102, which indicates the audit log was cleared.
Sources
Last reviewed: 19 October 2026.
