Attack technique that hijacks legitimate OS tools and features to move through a network, without dropping detectable malware.
Living off the land refers to a family of offensive tactics in which the attacker avoids dropping malicious tools on the target and instead abuses binaries, scripts and features already present on the system, such as PowerShell, WMI, certutil or PsExec on Windows. This approach effectively bypasses signature-based antivirus and EDR solutions, since the executed processes are executables signed by the OS vendor. APT groups and certain ransomware operators have widely adopted this method to extend the reconnaissance and lateral movement phase before the visible trigger of the attack. For defensive teams, detection requires fine-grained behavioral analysis rather than simple signature correlation. For cyber insurers, LotL attacks significantly extend the attacker's average dwell time in the network, increasing the potential severity of the loss, particularly regarding data exfiltration and business interruption.
A forensic investigation following a cyber claim reveals that the attacker spent six weeks inside the network without dropping a single malicious file, using only PowerShell and WMI to move laterally. The SOC detected the incident only at the moment of ransomware deployment. The undetected dwell time widens the scope of compromised data and triples the loss estimate.
LotL, LOtL, attaque sans fichier, fileless attack, utilisation d'outils légitimes