What are living off the land (LOTL) attacks and how do you detect them?

Living off the land (LOTL) is when attackers use legitimate tools already present in your environment, such as built-in administration utilities, instead of bringing their own malware. Because the activity looks like normal administration, signature-based tools often miss it. The defense is knowing what normal looks like and logging enough to see departures from it.

What does the official guidance say?

In February 2024, CISA, the NSA, the FBI and partner agencies from Australia, Canada, the United Kingdom and New Zealand published joint guidance, Identifying and Mitigating Living Off the Land Techniques. The guidance describes LOTL actors as abusing native tools and processes on systems, often using living off the land binaries (LOLBins). They do this across on-premises, cloud, hybrid, Windows, Linux and macOS environments, and the activity can blend in with typical system and network behavior.

The guidance gives two reasons LOTL works. First, many organizations lack security and network management practices, such as established baselines, that support detection, so defenders find it hard to tell legitimate from malicious behavior. Second, there is a general lack of conventional indicators of compromise tied to the activity. It also notes that attackers avoid investing in custom tools. The guidance draws on incident response work at critical infrastructure organizations, including those compromised by a PRC state-sponsored group the agencies call Volt Typhoon.

Why do defenders struggle?

The guidance lists several reasons even mature teams have trouble:

• Security teams work in silos apart from IT teams and their operational workflows, so they do not know what administrators normally do.
• Reliance on untuned endpoint detection and response systems, which may not alert on LOTL, and on discrete indicators that attackers can change or hide.
• Default logging configurations that do not capture enough detail to separate malicious activity from legitimate administration.
• The challenge of finding a small amount of malicious activity within large volumes of log data.

It also adds an honest limit: there is no foolproof solution to fully prevent or detect LOTL.

A constructed example

At 02:10 an account belonging to a database administrator runs a built-in command that lists domain accounts, then another that copies a file to a file share. No malware is installed and no antivirus alert fires. The account is real, and the commands are real. What is wrong is the pattern: this administrator has never run those commands, and never at 02:10. A team with baselines and central logs sees the departure. A team with default logs on each host sees nothing, and the attacker may erase those logs later anyway.

What do the agencies recommend?

Detection best practices from the guidance:

1. Implement detailed logging and aggregate logs in an out-of-band, centralized location that is write-once, read-many, so attackers cannot modify or erase them.
2. Establish and keep up baselines of network, user, administrative and application activity, and least privilege restrictions.
3. Build or acquire automation, such as machine learning models, to review all logs against the baselines and alert on defined anomalies.
4. Reduce alert noise by tuning for priority and reviewing detections continually.
5. Use user and entity behavior analytics.

Hardening best practices:

1. Apply vendor-recommended hardening guidance.
2. Use application allowlisting and monitor the use of common LOLBins.
3. Improve IT and OT network segmentation and monitoring.
4. Require authentication and authorization for all human-to-software and software-to-software interactions regardless of network location.

How to check or apply this

1. Confirm that process creation, authentication and administrative command logs go to a central store that your administrators cannot edit.
2. Pick your five most privileged accounts. Write down what each normally does, from where, and when. That is your first baseline.
3. List administration tools that normal users should never run, and alert when they do.
4. Start application allowlisting on servers, in audit mode first, then enforce.
5. Remove standing admin rights where possible, and require approval for elevated sessions.
6. Run a purple-team exercise: have a tester use built-in tools only, and check what your logs and alerts caught.
7. Review the CISA guidance's detail sections, since they include log source lists and hunting recommendations by platform.

Quick check

Sources

• CISA, Identifying and Mitigating Living Off the Land Techniques
• Joint guidance PDF (CISA, NSA, FBI and partners)

Last reviewed: 18 October 2026.