Living Off the Land Attacks: Detection and Response Guide
When offered by itself, the most common guidance on living off the land attacks is also the least helpful: search for suspicious PowerShell, prevent LOLBins, and trigger alerts whenever a signed Microsoft binary acts unexpectedly. Such controls are valuable, yet they do not address the operational issue. PowerShell, WMI, certutil.exe, and bitsadmin.exe are legitimate administrative tools, and attackers exploit them exactly because...