S02E25

What Does “Living off the Land” Mean?

Living off the land means using legitimate tools, utilities, and administrative capabilities already present in an environment to perform malicious actions. Certification exams may describe an attacker using built-in scripting, command-line, remote-management, or system-administration tools and ask why traditional malware detection may not identify the activity. Because these tools also support normal business operations, defenders must evaluate how, when, where, and by whom they are used rather than blocking every instance. Application control, least privilege, enhanced logging, command-line monitoring, and restrictions on administrative utilities can reduce misuse. During an investigation, analysts should compare suspicious tool activity with expected user behavior and examine the commands, parent processes, destinations, accounts, and systems involved. Produced by BareMetalCyber.com, where you’ll find more cyber audio courses, books, and information to strengthen your educational path. Also, if you want to stay up to date with the latest news, visit DailyCyber.News for a newsletter you can use, and a daily podcast you can commute with. And dont forget Cyberauthor.me for the companion study guide and flash cards!