Topic starter
12/07/2026 12:17 pm
TL;DR: Living off the land attacks accounted for 84% of major incidents in a 2025 analysis of more than 700,000 cases, because attackers used trusted tools like PowerShell, WMI, SSH, and RDP to move laterally and avoid malware-based detection, according to Illumio. Malware signatures are no longer enough when native administration activity is the disguise.
Editorial analysis by NHI Mgmt Group, based on content published by Illumio: “Modern Trojan Horse: How Attackers Live Off the Land and How to Stop Them”.
By the numbers:
- A 2025 analysis of over 700,000 incidents found that 84% of major attacks involved living off the land techniques.
Key questions
Q: What breaks when attackers use trusted admin tools instead of malware?
A: Traditional malware-centric controls miss the intrusion because the activity looks like normal administration.
Q: Why do native tools make lateral movement harder to detect?
A: Native tools are already expected in most environments, so their use does not automatically stand out.
Q: How can security teams tell whether LOTL detection is working?
A: LOTL detection is working when unusual command chains, remote admin patterns, and east-west movement are surfaced quickly enough to isolate the host or session before spread.
Practitioner guidance
- Map native tool abuse paths Inventory which approved administrative tools can reach sensitive systems, then flag unusual combinations of process, parent process, and remote destination.
- Reduce standing administrative reach Limit who can use PowerShell, WMI, SSH, RDP, and remote support tools against production systems, and review those privileges as sessions, not just accounts.
- Detect lateral movement by behaviour Build detections for east-west communication spikes, unusual remote execution chains, and in-memory command activity that appears normal in isolation.
Bottom line: Living off the land attacks succeed because they convert legitimate administrative tooling into a concealment layer for intrusion.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
12/07/2026 12:31 pm
LOTL is a governance failure before it is a detection failure. When defenders define suspicious activity only as malware execution, they leave a wide gap for legitimate tooling to become attacker transport. The real problem is that operational trust and security trust are being treated as the same thing. Practitioner conclusion: separate approved administration from approved abuse tolerance.
A question worth separating out:
Q: How should organisations contain living off the land attacks in practice?
A: They should pre-authorize rapid isolation, limit administrative reach, and monitor trusted tools as potential abuse channels. Containment has to happen at the session and host level because attackers may never drop a file. The goal is to cut off movement and privilege expansion before the activity becomes widespread.
👉 Read our full editorial: Living off the land attacks are outpacing malware-only detection