How to Spot Living-off-the-Land Abuse in Normal Admin Activity
Summary
Attackers use legitimate tools such as PowerShell, WMI, and RMM software to blend in. Assess the user, system, process chain, command, and follow-on activity; improve logging and restrict access to high-risk tools.
Key points
- Living-off-the-land abuse uses trusted tools and existing permissions to conceal malicious activity among routine administration.
- Check whether the user, location, timing, and purpose of tool use match normal administrative patterns.
- Unusual process ancestry, remote execution paths, or commands that only appear routine can reveal suspicious activity.
- Look for follow-on reconnaissance, account creation, credential access, lateral movement, persistence, or ransomware preparation.
- The article cites attackers using Action1 to deploy ScreenConnect for persistent remote access.
- Improve process visibility and logging, limit access to high-risk tools, and remove overlooked systems and accounts.
Article Details
- Defense Focus
- Distinguish malicious living-off-the-land activity from routine administration by evaluating the user, execution location, process ancestry, command line, and subsequent behavior against the environment's baseline.
- Detection Methods
- Compare the account and user's role with their normal use of administrative tools.
- Check whether the system running the tool is an approved management server, laptop, or remote-management endpoint.
- Inspect process ancestry for unusual parent processes, remote execution paths, or shells launched in contexts suggestive of staging.
- Review command lines for subtle deviations from normal administrative workflows.
- Correlate activity with follow-on reconnaissance, account creation, remote execution, credential access, lateral movement, persistence, or ransomware preparation.
- Pressure-test the full activity chain against the environment's behavioral baseline.
- Data Sources
- Process chains and parent-process relationships
- Administrative activity and account-use logs
- Command-line data
- Endpoint and execution-location telemetry
- Subsequent activity across the attack chain
- Defensive Actions
- Improve visibility into process chains and strengthen logging for administrative activity.
- Restrict access to high-risk tools to users who need them.
- Review and reduce overlooked systems, dormant accounts, and over-permissioned remote-management access.
- Investigate suspicious activity as a connected chain rather than judging an individual command or legitimate tool in isolation.
People
Austin WorlineIdentified as a Huntress Security Operations Center speaker discussing LOLBins tradecraft.Beth RobinsonNamed author of the article.Brett LeathermanIdentified as Assistant Director of the FBI Cyber Division and a participant in a promotional event.John HammondNamed as a participant in a promotional event about partnerships disrupting cybercrime.Kyle HanslovanNamed as a participant in a promotional event about partnerships disrupting cybercrime.
Products
Action1Figure 1: Attackers used Action1, a legitimate vulnerability management tool, to deploy ScreenConnect for persistent remote access.PowerShellLiving-off-the-land (LoTL) abuse is hard to catch because attackers use legitimate tools already in your environment, like PowerShell, WMI, and RMM software, to make malicious activity look like routine admin work.ScreenConnectFigure 1: Attackers used Action1, a legitimate vulnerability management tool, to deploy ScreenConnect for persistent remote access.