Malware-free cyberattacks, also known as malwareless attacks, can exploit legitimate tools already present on systems to carry out malicious activities. Living off the Land techniques pose a detection challenge because they rely on resources commonly used by IT teams, such as PowerShell, WMI, Certutil, BITS, Bash, or SSH. In light of this scenario, cybersecurity is evolving toward models that complement signatures and patterns with greater visibility, context, and behavioral analysis. Technologies such as EDR, XDR, SIEM, and UEBA, along with principles like Zero Trust, contribute to this approach. Protection also requires appropriate policies, proper configuration, privilege management, and effective monitoring and response procedures.
“Living off the Land” attacks use legitimate tools available on systems, so detecting them requires analyzing not only what is running but also its context and behavior.
For many years, we have been accustomed to relying on one fact: to infect a system, it was necessary to transmit and inject malware into it. Whether it was an executable file, a document with macros, or a script—among other things—we had a malicious “vector” through which the attacker infected the system. Thus, if this malicious element matched a known signature or behaved strangely, the alarms in our bunker would sound, and the threat could be detected and neutralized.
However, this is no longer the only possible scenario.
Among the techniques used in certain cyberattacks are malwareless approaches. In other words, it is no longer always necessary to deliver a malicious file to the victim’s computer. Instead, the operating system’s own tools can be used to carry out malicious activities.
This gives rise to a challenge on both fronts: attack and defense. The threat no longer necessarily has to be crafted externally and then transmitted to the computer; rather, it can leverage the power of native tools as an execution mechanism to cause damage. From a protection standpoint, this poses a challenge, as these are legitimate tools whose blanket blocking may not be feasible in certain environments due to their use in routine administrative tasks.
What is “Living off the Land” in cybersecurity, and how does it work?
In this scenario, it is important to familiarize yourself with the cybersecurity concept of Living off the Land. The term means “living off the land” and comes from the field of survival, where one lives solely off the resources available in one’s immediate environment. The concept aligns with the description above, as the attacker can rely on the resources natively provided by the operating system.
Focusing on cybersecurity and getting more technical, the legitimate executables used for these purposes are known as LOLBins (Living off the Land Binaries) or LOLBas (Living off the Land Binaries and Scripts), with the latter concept including system scripts and libraries.
What legitimate tools can be exploited in Living off the Land attacks?
We’re talking about native system tools and attacks that don’t necessarily rely on conventional malware, but we haven’t yet given them specific names. Among the tools that can be exploited by cybercriminals are resources that, for the IT team, are essential to their daily operations:
- PowerShell: It’s the star of the show—the one everyone wants to dance with. It has enormous potential, as it can practically manage an entire Windows environment. For the IT team, it’s the solution to many problems; an attacker may try to use it to load code into memory, perform network reconnaissance, or download payloads, among other actions.
- WMI and wmic: These are very useful utilities for an administrator, as they allow for remote management of components. They can also be used maliciously to attempt lateral movement across a network.
- Certutil: This is a tool for managing digital certificates and certificate authorities. It has settings that can allow for the download of remote files—a capability that could be exploited for malicious purposes.
- BITS: This is a Windows transfer service used, for example, to download updates in the background. It can also be misused to transfer information.
- Bash, SSH, and Linux/Unix utilities: The Windows ecosystem isn’t the only one in the mix. On Linux systems, there are numerous tools—such as curl, wget, and nc—that can also be used for malicious purposes.
Why do “Living off the Land” attacks pose a challenge to traditional defenses?
“Living off the Land” techniques have characteristics that can make them difficult to detect using security approaches focused primarily on identifying malicious files:
- Evasion of certain defenses. These techniques can exploit the trust associated with legitimate system tools. Solutions such as PowerShell or Certutil are digitally signed by Microsoft. Their legitimate nature can make it difficult to identify certain malicious activities using approaches that rely primarily on signatures.
- Camouflage among normal activity. Tools such as PowerShell or WMI may run thousands of times a day across a company’s IT infrastructure. Distinguishing a legitimate execution from a potentially malicious one can be particularly complex when these tools are used regularly and intensively.
- Reduced development effort. Creating malware capable of bypassing controls, establishing persistence, encrypting data, or extracting information can require considerable effort. Through LotL, the attacker seeks to exploit tools already present on the system and use them for purposes other than those for which they were designed.
Why Do Malware-Less Cyberattacks Challenge Traditional Security?
One of the challenges faced by certain traditional approaches is that they may have less context to analyze actions performed using legitimate tools. For decades, much of security has relied on signatures and patterns. If software was digitally signed by a legitimate source and corresponded to an authorized solution, its execution might not be considered suspicious in and of itself.
On the other hand, broadly blocking the aforementioned administrative tools may not be feasible, as they are essential solutions in the daily operations of many IT teams.
As a result, security professionals face a dilemma: anti-malware approaches focused primarily on signatures may have less context to identify this type of activity, while restricting all legitimate tools could disrupt normal operations.
So, how do we protect ourselves? What approaches are available? To address this challenge, we need more information about events: not only the tool used, but also the actions taken, who performed them, when, and in what context. In other words, the security architecture and its solutions must evolve.
How do visibility, context, and behavior help detect threats?
Modern cybersecurity can rely on three essential concepts: visibility, context, and behavior. Defense thus evolves from primarily static approaches toward a more dynamic security model, capable of analyzing what is happening at any given moment in greater depth.
Pattern matching and signatures remain relevant mechanisms, but they may need to be complemented by greater visibility, information correlation, and behavior-based techniques.
What role do EDR and XDR play in detecting “Living off the Land” attacks?
The first line of defense is based on understanding what is happening on the system in great detail. This is where EDR solutions come into play.
These types of tools go a step beyond primarily signature-based antimalware systems, as they can monitor and log device activity to collect telemetry.
Thus, when a process such as “powershell.exe” is executed, the EDR can collect information about which process initiated it, what actions it performs, and what subprocesses it creates.
This level of telemetry can help identify anomalous behavior associated with the process and facilitate the generation of alerts or the implementation of response measures, depending on the solution’s capabilities and configuration.
As an extension of this model, we have XDR solutions. These can integrate information from various domains, such as devices, the network, the cloud, email, or identity. Depending on their capabilities and integrations, they can facilitate coordinated response actions across different components of the security architecture.
It all relies on telemetry and having detailed information to interpret what is happening.
How do SIEM and UEBA use context to detect anomalous behavior?
Collecting telemetry from thousands of devices via EDR systems can generate millions of events that are difficult to manage. Therefore, it may be important to incorporate a SIEM with UEBA capabilities into the environment.
What is this? A SIEM is a system designed to centralize and process large volumes of information. This makes it possible to design different use cases so that, when a specific pattern is identified, an alert is generated.
UEBA capabilities, on the other hand, can analyze user and device behavior patterns and help identify activities that deviate from what is considered normal.
This might be a bit complex, so it’s best to look at an example. Let’s imagine that a user in the Accounting department runs “powershell.exe” at 3:00 a.m. At the same time, connections to another server within the organization made by that same user are observed at the exact same time. The process is legitimate, and taken in isolation, the connections do not necessarily indicate a malicious signal. However, this behavior may not be part of that user’s usual pattern.
Although each action on its own may seem legitimate, a behavioral analysis tool could generate an alert by taking into account the full context and the combination of observed activities.
What does the Zero Trust model offer in the face of these types of cyberattacks?
A model that brings together many of the measures we’ve discussed is Zero Trust. In traditional models, when a user or tool passes a security check, they may be granted access without further checks necessarily being applied throughout the entire session.
Zero Trust proposes a different framework based on the principle of least privilege and the application of continuous verification through various security controls.
Continuing with the previous example, one of the first questions would be: Does a user in the Accounting department need to run PowerShell? If the answer is no, applications, permissions, and tools can be tailored to the needs associated with each type of user.
Passing a security check only at the beginning of a connection may not be sufficient. A Zero Trust approach seeks to apply continuous verification and the principle of least privilege through various controls, so that potential deviations from security policies can be identified and managed.
I want to emphasize that Zero Trust is not a specific tool. It is a model, a mindset, or a methodology that encompasses multiple solutions with diverse objectives, such as access policies, identity management, device protection, and segmentation, among others.
What shift in approach does cybersecurity require in the face of “Living off the Land”?
“Living off the Land” techniques demonstrate that a cyberattack does not always need to introduce conventional malware into an organization’s systems.
It can exploit legitimate tools and permissions obtained by the attacker to carry out malicious activities.
This drives the evolution toward an approach based on data analysis and the behavior of users and devices. Pattern recognition and signatures remain relevant mechanisms, but they may need to be complemented by deeper visibility, information correlation, and behavior-based techniques.
However, technology alone is not enough. It is essential to establish appropriate policies, maintain properly configured systems, review privileges, and have effective monitoring and response procedures in place.
The key is not to prevent the use of all legitimate tools, but to have the necessary visibility and controls to distinguish their normal use from potentially malicious activity.
In this context, cybersecurity is also a key component in moving toward trust-based access to digital technologies. Telefónica has taken on the undeniable challenge of becoming the best gateway for citizens to access digital technologies—a goal that involves continuing to evolve in innovation, networks, services, and capabilities that support the transformation of the digital environment.
Frequently Asked Questions
What is a “Living off the Land” attack?
It is an approach in which an attacker exploits resources and tools natively available in the operating system to carry out malicious activities, rather than necessarily relying on the introduction of conventional malware.
What are LOLBins and LOLBas?
LOLBins refers to legitimate executables used for these purposes. LOLBas expands the concept to Living off the Land Binaries and Scripts, also including system scripts and libraries.
What tools can be used in a “Living off the Land” attack?
Tools that can be exploited include PowerShell, WMI, wmic, Certutil, and BITS, as well as utilities from Linux and Unix environments such as Bash, SSH, curl, wget, and nc.
Why is it difficult to detect a malware-less attack?
Because it can make use of legitimate tools that are also commonly used by IT teams. The challenge lies in distinguishing normal usage from potentially malicious behavior based on context.
What roles do EDR and XDR play?
EDR can provide detailed visibility into process activity on devices. XDR can expand this approach by integrating information from areas such as devices, the network, the cloud, email, or identity, depending on the capabilities and integrations of each solution.
What are SIEM and UEBA used for in this context?
SIEM allows for the centralization and processing of large volumes of information and the generation of alerts associated with specific patterns. UEBA capabilities can analyze user and device behavior to identify activities that deviate from what is considered normal.
What is Zero Trust?
Zero Trust is a model, mindset, or methodology that combines various security controls and applies principles such as continuous verification and least privilege.
Is technology alone enough to protect an organization?
No. In addition to technology, it is necessary to establish appropriate policies, keep systems properly configured, review privileges, and have effective monitoring and response procedures in place.
