Living-off-the-Land Techniques: Why Normal Tools Can Become Attack Tools

Key judgments

Living off the land defeats investigation that depends on indicators. Joint guidance from CISA, the NSA, the FBI and their international partners explains that attackers abuse trusted native binaries, often with valid signatures, and can change file names, paths, hashes and command-line syntax freely. There is no unique artifact to search for. Fact.
Without baselines and command-line logging, investigators cannot separate malicious use from routine administration. The cost is either scope inflation, where everything is assumed compromised, or false closure. Assessment.
Default logging is usually the limiting factor. The Volt Typhoon advisory notes that WMI tracing and deep PowerShell logging are off by default, and that process creation events need command-line capture switched on. Fact.
This is not a state-actor niche. Mandiant says both financially motivated and espionage groups abuse native functionality and legitimate tools to reduce detection. Akira, Scattered Spider and Storm-0501 each used legitimate software in documented ransomware and extortion cases. Fact.
Time works against the investigator. Mandiant reports a global median dwell time of 14 days, with some espionage and state-linked categories far longer, and warns that standard 90-day log retention leaves organizations blind to initial access in long intrusions. Fact.

Source basis and confidence

Technique descriptions come from government guidance and advisories: the joint CISA, NSA, FBI and partner guidance on living off the land, the Volt Typhoon advisory distributed by the Australian Cyber Security Centre, and CISA advisories on Akira and Scattered Spider. Mandiant and Microsoft Threat Intelligence provide incident context.

Confidence is High for how the techniques work and Medium for how common they are. None of the sources used here measures how often living off the land appears across intrusions, so this brief gives no prevalence figure.

What counts as living off the land

The term covers three overlapping families of tooling. Native operating system binaries are the best known: wmic, ntdsutil, netsh, PowerShell, vssadmin and similar. Legitimate third-party software is the second: remote monitoring and management tools, file transfer utilities and remote administration tools that an organization may well own already. The third is cloud-native management features, such as data transfer utilities and role operations, where the action is a supported function and not a binary at all. The CISA guidance lists all of these categories, including endpoint configuration, patch management, mobile device management and database management tools.

What unites them is that the attacker brings little or nothing new. The tools already exist, are already trusted and are often already allowed.

Familiar tools, documented abuse, and the investigator’s question

Tool	Legitimate use	Documented abuse	What the investigator should ask
ntdsutil	Active Directory database maintenance	Creating copies of the directory database and the SYSTEM hive for offline password cracking (Volt Typhoon advisory).	Who ran it, from which session, and was any credential rotated afterwards? If not, treat domain credentials as exposed.
wmic	Querying and managing Windows systems	Enumerating local drives and launching processes, including ntdsutil runs (Volt Typhoon advisory).	Which host launched it, what did it launch, and is that normal for that host?
netsh port proxy	Network configuration	Forwarding traffic to internal hosts through port proxy rules (Volt Typhoon advisory).	Is there a port proxy rule that no change record explains?
PowerShell	Automation and administration	Querying logon events to identify successful logons (Volt Typhoon advisory).	What did the script do? Are script block logs available?
AnyDesk and similar remote tools	Remote support	Used by Scattered Spider and Akira, and trusted by many security tools because they are legitimate applications.	Is the tool approved? Who installed it, and when was it first seen?
Rclone, WinSCP, MEGA	File transfer and cloud storage	Used by Akira for exfiltration.	Which hosts ran them, what volume left, and to where?
PsExec	Remote administration	Broad allowances for it give attackers room to move laterally (CISA guidance).	Which accounts and hosts normally use it, and was this one of them?
AzCopy	Azure data transfer	Used by Storm-0501 to copy data out of storage accounts.	Which identity ran it, against which storage accounts, and from where?

How the investigation changes

Three questions replace the search for a known-bad artifact.

Is this normal for this identity, host and time? That requires a baseline. CISA recommends baselining installed software, account behavior, network traffic and privileged account activity, including which tools those accounts use, when, and from which devices. The Volt Typhoon advisory adds a caution: do not treat a match as malicious on its own, and account for variation in arguments, paths and ports between environments.
What came immediately before it? A single wmic or PowerShell event is rarely suspicious alone. The signal is the sequence: an unusual logon, then a remote process launch, then a database copy. Provenance, meaning the logon, the parent process and the ticket or session behind the command, carries more weight than the command.
What did it reach? For every host, account and dataset, record whether the compromise is established, assessed or unknown. Scope grows from the first answer. Investigators who close at the first host miss the account that the attacker took with them.

The logging that decides what you can conclude

Whether an investigation can answer those questions is settled long before the incident. The government advisories converge on a short list:

Process creation auditing with command-line capture, so that each launch records its arguments.
Deep PowerShell logging and WMI tracing, both off by default.
Forwarding of logs to a hardened, central location that an intruder on a host cannot alter, with every cleared-log event investigated.
Priority coverage of externally facing systems, authentication systems and domain controllers if resources are limited.
Retention beyond 90 days, because long intrusions outlast it.

If these were not enabled when the activity happened, they cannot be recovered afterwards. In that case “unable to determine” is a legitimate finding, and the response has to scope for it, usually by assuming a wider compromise than the evidence can prove.

Mistakes that lengthen investigations

These are the author’s judgments, drawn from the failure points the guidance describes.

Searching for hashes and file names when the activity used none.
Treating valid credentials as proof that activity was authorized.
Rebuilding the affected host while leaving the stolen credentials valid.
Closing low-impact alerts without asking whether they were a precursor. Mandiant advises treating routine malware alerts as possible precursors to a handoff.
Letting IT operations and security work separately. CISA names siloed teams as a reason these techniques go unnoticed.

What to change

Switch on command-line, PowerShell and WMI logging, and send it somewhere an attacker cannot reach.
Publish which administrative tools each role is allowed to use. CISA recommends restricting such tools to defined business roles. The list becomes the baseline.
Keep an approved list of remote access tools, and block the rest.
Use just-in-time administration and limit domain administrator logons to domain controllers.
Extend retention beyond 90 days for the systems that matter most.
Test it. Mandiant recommends red team exercises that measure detection and response against living-off-the-land techniques.

Where this brief is limited

The Volt Typhoon behavior comes from a state-sponsored actor targeting critical infrastructure, and it is not a template for every intrusion. The tool table is illustrative. It is not a block list, because every tool in it has legitimate uses that an organization may depend on. The brief makes no claim about how often these techniques occur.

Questions for leadership

Which administrative tools are approved in our environment, for whom, and on which hosts?
Would our logs let an investigator tell a malicious command from a routine one today?
Are our retention periods long enough to cover a typical long intrusion?

Sources

CISA, NSA, FBI and international partners, Identifying and Mitigating Living Off the Land Techniques — Joint guidance on detection and hardening
CISA, NSA, FBI and international partners (published by the Australian Cyber Security Centre), PRC state-sponsored actor living off the land to evade detection — Joint advisory on Volt Typhoon techniques, logging and baselining
Mandiant (Google Threat Intelligence), M-Trends report — Annual analysis of Mandiant incident response investigations
CISA, FBI and partners, Akira ransomware joint advisory — Government advisory, updated edition
CISA and partners, Scattered Spider joint advisory — Government advisory with updated tactics and mitigations
Microsoft Threat Intelligence, Storm-0501 and cloud-based ransomware — First-party incident analysis