Playbook Of The Week - Fending Off Living Off the Land Attacks

Living Off the Land (LOTL) attacks are used by attackers to evade detection by the system's own native utilities, scripting languages, or trusted applications, rather than resorting to custom or malicious code that may raise suspicion. The use of native tools (Living Off the Land binaries, or LOLBins) also makes LOTL attacks far harder to detect via traditional detection methods.

Real world examples of how LOTL attacks are executed can be found in multiple threat research report...