Living off the Land Guide: LOLBins and Dual-Use Tools

Living off the land (LOTL) means an intruder works with the operating system's own signed tools and your existing administration software, so there is no malware to find and the activity looks like routine administration. Joint guidance from CISA, NSA, FBI and Five Eyes partners says the technique "continues to be effective with little to no investment in tooling", and the same agencies found Volt Typhoon had kept access to some victim networks "for at least five years". This guide is for SOC analysts, detection engineers and endpoint hardening teams. It describes abused binaries and dual-use tools only at the level of MITRE ATT&CK, then concentrates on telemetry, detection, application control, hardening, response and the privileged identities LOTL depends on.

Key takeaways

• Signatures and hashes do not help. LOLBins are legitimate, usually Microsoft-signed files, so detection depends on context: parent, command line, network activity, account and host role.
• Command-line telemetry is the foundation. Event 4688 with command lines, script block logging (4104) and Sysmon or EDR process lineage, centralised and protected.
• Application control removes much of the toolkit. Microsoft's recommended block rules, App Control script enforcement and ASR rules take away binaries most users never need.
• Baselines separate administrators from intruders. Know which accounts run which tools on which hosts, or every alert is ambiguous.
• LOTL runs on stolen privilege. Built-in tools are only as dangerous as the account running them, so tiering, privileged access workstations and scoped service accounts are core controls.

What living off the land is and why it works

In ATT&CK v20 most LOLBin techniques sit under the Stealth tactic (TA0005). The central one is System Binary Proxy Execution (T1218, called Signed Binary Proxy Execution in older versions), which adversaries use to "bypass process and/or signature-based defenses" by running content through trusted binaries. LOTL also covers:

• Native administration and discovery tools: WMI, shells, networking and directory utilities. Volt Typhoon relied on them for most of its activity.
• Non-Windows equivalents: the joint guidance names curl, systemctl and cron on Linux, and osascript and launchctl on macOS.
• Dual-use tools: third-party software with legitimate uses, such as AdFind, automation interpreters and remote monitoring and management (RMM) products.
• Valid accounts (T1078): real credentials make the tool use look authorised.

The guidance explains why it succeeds: trusted signatures mislead defenders, many organisations have no baselines, untuned EDR and default logging, and security and IT teams work in silos. It also states: "There is no foolproof solution to fully prevent or detect LOTL activity." The aim is to shrink the available toolkit and make the rest observable.

Community catalogues: the guidance points defenders to LOLBAS (Windows binaries, scripts and libraries classified by function, such as Download, Encode, Compile and AWL bypass, and mapped to ATT&CK; the certutil entry, for example, links Sigma, Elastic and Splunk rules), GTFOBins (Unix), LOOBins (macOS) and LOLDrivers (abusable signed drivers, covered in the EDR Evasion and Defence Guide). LOLRMM does the same for remote access tools, listing install paths, services, registry values, domains and signing details. Use these to scope detection coverage, not as blocklists.

LOLBin reference: proxy execution, scripting and transfer

This table shows why each binary is watched, not how it is abused. "Block list" means Microsoft's App Control recommended block rules.

Renamed utilities (T1036.003): a copied and renamed system binary defeats name-based rules. Compare the image name with the PE original file name, which Sysmon and most EDR record, as the joint guidance recommends. The ASR rule "Block use of copied or impersonated system tools" (c0033c00-d16d-4114-a5a0-dc9b3a7d2ceb) blocks System32 and SysWOW64 copies run elsewhere "even if the files are signed by Microsoft".

Discovery and system utilities

Administrators use these daily, so the signal is who runs them, where and in what sequence. Storm-0501 and Volt Typhoon both used this set for reconnaissance.

Remote monitoring and management abuse

ATT&CK T1219 Remote Access Tools describes adversaries using "legitimate remote access tools to establish an interactive command and control channel". Advisory AA23-025A (CISA, NSA, MS-ISAC) explains that portable RMM executables need no installation or administrator rights, bypassing common software controls, and that RMM use "generally does not trigger antivirus or antimalware defenses". It names ScreenConnect and AnyDesk. Microsoft reported Storm-0501 deploying Level.io, AnyDesk and NinjaOne.

• One approved RMM: allow it by publisher rule. The advisory says application control "should prevent both installation and execution of portable versions of unauthorized RMM software".
• Hunt: sweep for LOLRMM install paths, services and domains; treat unapproved products as incidents until explained.
• Network: block unapproved RMM domains at the proxy and allow approved RMM only through VPN or VDI.
• Tier 0 consoles: RMM agents usually run as SYSTEM, so console access is effectively estate-wide administration. See the Remote Access Identity Guide.

Operational technology: engineering workstations carry powerful native tools. The joint guidance calls bastion hosts and privileged access workstations "especially critical in industrial control system (ICS) environments", and the Volt Typhoon advisory adds monitoring IT-to-OT paths and segmenting OT from IT.

Telemetry: what to collect

The joint guidance asks for verbose logging of command lines, PowerShell and WMI, stored "in an out-of-band, centralized location that is write-once, read-many", because local logs roll over and some actors clear them.

Microsoft warns that "Command line arguments can contain sensitive or private information such as passwords or user data", so restrict who can read the Security log and its SIEM index, and treat any secret found there as exposed. See the Log Management and Retention Guide and the Windows Event Log Guide.

Detection logic and baselining

Name-only rules flood the SOC or are defeated by renaming, and the joint guidance warns against "overly broad detection rules". Combine context:

• Unexpected parents: Office, browsers, PDF readers or web server processes launching script hosts, shells or proxy binaries.
• Signed binaries on the internet: connections or DNS lookups from certutil, mshta, regsvr32, msbuild or rundll32 beyond your update and PKI infrastructure.
• Wrong place, wrong name: system binaries outside System32 or SysWOW64, or image names that differ from the original file name.
• Rarity by host role: msbuild on a finance laptop, directory queries from a web server.
• Discovery bursts: several discovery utilities from one session within minutes, especially under a service account.
• Account context: admin tools run by non-administrators, service accounts starting interactive tools, administration from non-administrative workstations. Time-of-day rules help, but Volt Typhoon avoided using credentials out of hours.
• Evidence removal: log clearing, audit policy changes (4719) and shadow copy deletion. Escalate immediately.

Baselines: the guidance recommends baselines for installed tools, account behaviour, network traffic and privileged accounts, with alerts on LOLBin use outside them. Summarise 30 to 60 days of process telemetry by account, host group, tool and parent, agree the legitimate patterns with IT operations, and alert on the rest. Moving administration to a few tools on known management hosts keeps the baseline small. See the Detection Engineering Guide and the SIEM Guide.

Prevention and hardening

• Recommended block rules: "Unless your use scenarios explicitly require them, Microsoft recommends that you block the following applications." The list includes mshta, msbuild, wmic, wscript, cscript, wsl, dotnet, the cdb, windbg and kd debuggers, and Microsoft.Workflow.Compiler.exe, and Microsoft updates it as issues are found. Deploy it as a separate base policy, or remove its two "Allow all" rules before merging into an explicit allowlist.
• Script enforcement: under App Control, PowerShell runs disallowed scripts in Constrained Language Mode and Windows Script Host blocks them. See the Application Allowlisting Guide.
• AppLocker defaults: the default rules allow the whole Windows folder, LOLBins included. Add deny rules or move to App Control.
• ASR rules: PSExec and WMI process creation (d1e49aac-8f56-4280-b9ba-993a6d77406c), WMI persistence (e6db77e5-3df2-4cf1-b95a-636979351e5b), JavaScript or VBScript launching downloaded content (d3e037e1-3eb8-44c8-a917-57927947596d), obfuscated scripts (5beb7efe-fd9a-4556-801d-275e5ffc04cc) and Office child processes (d4f940ab-401b-4efc-aadc-ad5f3c50688a). Configuration Manager "relies heavily on WMI", so audit the WMI rules first.
• Remove what is not needed (M1042): unapproved RMM and interpreters, PowerShell 2.0, the WebClient service where WebDAV is unused, and WSL where nobody needs it.
• Egress control: the guidance says back-end servers such as databases and domain controllers should not have internet access, which removes most download and C2 uses at once. See the Network Segmentation Guide.
• Baselines: apply Microsoft security baselines or CIS Benchmarks; "Do not rely on default configurations." See the Windows Endpoint Hardening Guide and Endpoint Security Guide.

Choosing the control

Small organisations: enable command-line and script block logging, the ASR rules above and one approved RMM, cut server internet access, and buy detection from an MDR provider if needed. Large organisations: add the block rules as an App Control base policy, full allowlisting for tier 0 and OT, per-role baselines and purple team tests against relevant LOLBAS functions.

How to implement: a phased rollout

1. Telemetry. Enable 4688 with command lines, 4104 and Sysmon with a maintained configuration; forward to write-once storage with restricted read access.
2. Baseline. Collect 30 to 60 days and agree legitimate patterns and owners with IT operations.
3. Quick wins. Remove unapproved RMM, block .hta, .chm, .js and .vbs at the mail gateway, cut server internet access, remove PowerShell 2.0.
4. Audit mode. ASR rules in audit (1122) and the block rules as an audit-mode App Control policy (3076, 8028). Script enforcement changes mshta and Windows Script Host behaviour even in audit mode, so test those first.
5. Pilot ring. Enforce on IT devices, then a business ring for one patch cycle, tracking blocks (1121, 3077, 8029) and tickets per rule.
6. Enforce and detect. Move to block by ring and ship the context analytics above, tuned to the baseline.
7. Tier 0 and OT. Full allowlisting on domain controllers, identity, backup, hypervisor management, RMM and OT engineering hosts.
8. Rollback. Return an ASR rule to audit or add a scoped exclusion; keep block rules in a separate base policy so they can be withdrawn without touching the allowlist (a reboot may be needed); version every policy in source control.

Where identity fits

A LOLBin has exactly the privileges of its account. The Volt Typhoon advisory says the group relied mainly on valid credentials and used domain administrator accounts over RDP to reach domain controllers. In the Storm-0501 hybrid cloud attacks, Microsoft reported the actor "leveraged compromised Domain Admin accounts" alongside native discovery tools and commercial RMM.

• Tiering: restrict domain admin logons to domain controllers, and use privileged access workstations and just-in-time elevation. See the Privileged Access Management Guide and Active Directory and Entra ID Hardening Guide.
• Service accounts: deny interactive and RDP logon, prefer group managed service accounts, and alert when one starts a shell, script host or discovery tool. See the Service Account Security Guide.
• Tool consoles: RMM, EDR and software deployment consoles (T1072) need phishing-resistant MFA and monitoring, because their features are LOTL at scale.

Responding to LOTL activity

• Scope by account, not file: there is often no hash to sweep. Pivot on account, logon session and source host across EDR, 4688, Sysmon and authentication logs.
• Preserve early: collect endpoint logs before they roll and assume long dwell; the Volt Typhoon advisory notes application logs may persist longer on endpoints.
• Contain the identity: reset or disable accounts, revoke sessions, remove intruder RMM and block its domains. Where domain controllers may be affected, the advisory says to assume full domain compromise and reset krbtgt twice, allowing replication between resets.
• Emergency deny: if the abused binary has no business use, push a deny rule or ASR block estate-wide.
• Close the loop: turn each confirmed technique into a tested detection. See the Incident Response Guide and Lateral Movement Guide.

Measuring whether it works

• Telemetry coverage: share of endpoints and servers forwarding 4688 with command lines, 4104 and process events (target above 98 per cent).
• Prevention coverage: devices enforcing block rules and core ASR rules; tier 0 servers under full allowlisting.
• Unapproved remote access: unapproved RMM products seen per month (target zero) and median time to remove.
• Detection coverage: share of relevant LOLBAS functions with a detection that passed a purple team test.
• Alert quality: true positive rate and median triage time for LOTL analytics; a falling rate means the baseline is stale.
• Privileged exposure: share of admin tool use from privileged access workstations or jump hosts.

Common failure patterns

• Trusting signatures: allowing anything Microsoft-signed or any signed RMM. Signing proves the publisher, not safety, and vendors are breached too: the AnyDesk breach forced the vendor to revoke its code-signing certificate.
• Command lines missing: 4688 without the command-line setting, or logs kept only locally until they roll or are cleared.
• Allowlists that allow all of Windows: AppLocker defaults or allow-all App Control with no deny rules.
• RMM sprawl: several remote access products, no owner, nothing blocked at the proxy, leaving room for intruders such as Storm-0501, which installed three RMM products, to add their own.
• Name-only or wildcard rules: defeated by renaming or muted for noise.
• No baseline: analysts cannot tell administration from intrusion and close real alerts as benign.

Framework mapping

Practitioner checklist

• Enable 4688 with command lines, 4104 and Sysmon or EDR lineage everywhere, forwarded to write-once storage with restricted read access.
• Build and agree a 30 to 60 day baseline of admin tool use by account and host role.
• Deploy Microsoft's recommended block rules as an App Control base policy through audit and pilot rings.
• Enable the ASR rules for impersonated tools, PsExec and WMI, WMI persistence, script downloads, obfuscated scripts and Office child processes.
• Standardise on one RMM, block the rest by policy and proxy, and hunt monthly for others.
• Remove internet access from domain controllers, databases and other back-end servers.
• Ship context-based detections and test them against relevant LOLBAS functions.
• Restrict domain admin logons, use privileged access workstations, and alert on service accounts running interactive tools.
• Apply full allowlisting to tier 0, RMM and OT engineering hosts.

Standards and references

• CISA, NSA, FBI and partners: Identifying and Mitigating Living Off the Land Techniques
• CISA: PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure (AA24-038A)
• CISA: Protecting Against Malicious Use of Remote Monitoring and Management Software (AA23-025A)
• MITRE ATT&CK: System Binary Proxy Execution (T1218)
• MITRE ATT&CK: Remote Access Tools (T1219)
• Microsoft Learn: Applications that can bypass App Control and how to block them
• Microsoft Learn: Attack surface reduction rules reference
• Microsoft Learn: Command line process auditing

Related NHI Mgmt Group resources: Detection Engineering Guide · Application Allowlisting Guide · EDR Evasion and Defence Guide · Lateral Movement Guide · Service Account Security Guide