What does “living off the land” mean?¶

Living off the land means using legitimate tools, applications or system features already present in the environment to carry out malicious activity.

Evidential caution: that no malware file means no malicious activity occurred.

What this means¶

An offender may use:

command shells;

scripting tools;

administrative utilities;

remote services;

scheduled tasks;

system management tools;

cloud consoles;

built-in archive tools;

legitimate security products.

These tools may be used daily by administrators.

The evidential question is how, by whom and for what purpose they were used.

the account and session;

command line;

parent and child processes;

script content;

target system;

files accessed;

network connections;

management-platform records;

what activity followed.

Context, sequence, source, target and authorisation matter.

Living-off-the-land activity can reduce reliance on distinctive malware indicators and make behavioural evidence more important.

Living-off-the-land activity may also use signed binaries, standard interpreters and cloud administration features that generate little distinctive malware evidence. Investigators should compare normal administrative use with the specific command sequence, account, source device and targets. Behaviour and context may be more probative than file reputation.

The absence of a new executable may make process lineage and command content especially important. Preserve scripts, shell history, console transcripts and management jobs before they are overwritten. Standard tools can still create highly distinctive sequences when used for credential theft, discovery, movement or destruction. The operational takeaway is:

Focus on the command, account, sequence and effect, not merely whether the tool was built into the system or approved by the organisation.

================================================================================

What to check or do next¶

• Investigators should preserve:

Evidential limits¶

A legitimate tool name does not make the action legitimate.

Likewise, use of a powerful administrative utility does not automatically prove malicious intent.