How can security teams detect living off the land in OT?

What living off the land looks like in OT telemetry

In OT, living off the land is usually visible not as malware in the classic sense, but as ordinary tools behaving like an intrusion path. That means the detection problem is less about signatures and more about context: who used the tool, from where, against which asset, and whether the action fits the site’s normal engineering workflow. The same command can be benign in maintenance and suspicious in production control.

Detection gets stronger when security teams compare tool use with the site’s normal operating rhythm. A remote admin utility launched from an engineering workstation during a sanctioned change window is very different from the same utility launched from an IT host, a jump box with no maintenance ticket, or a vendor path that has never been used before. The aim is to spot tool use that is legitimate in isolation but abnormal in combination.

OT teams should also distinguish operator activity from control-system activity. A maintenance script, diagnostic binary, or remote management session can be expected on some assets and forbidden on others. That is why baselining needs to be asset-specific, not just network-wide. For practical OT-specific guidance, many teams anchor their detection model in OT Security Guide and pair it with authoritative OT architecture and segmentation guidance from NIST SP 800-82 Rev 3.

How to baseline normal engineering behaviour without blinding yourself

Effective OT detection starts with a workload baseline, not a generic rule set. Record which administrative tools are approved, which hosts may use them, what time windows are normal, and which accounts are allowed to invoke them. Then compare observed behaviour against those expectations at the level of site, cell, line, and role. A tool that is common in one zone may be out of place in another.

Good baselining also includes process context. Security teams should know whether a command was run interactively, by a scheduled task, through remote administration, or through an engineering package that is commonly used by plant staff. If you cannot tell those apart, you will either miss abuse or overwhelm operators with false positives. A broader OT risk view is well covered in Top 10 OT Security Risks, while OT and ICS Identity and Access Guide is useful when you need to decide which accounts and remote paths should ever be able to perform those actions.

Correlating telemetry with change records is especially important in OT because legitimate work is often sparse but high impact. If a maintenance utility runs outside the approved work order, if a remote session appears without a ticket, or if a vendor access path is used outside its normal schedule, that mismatch is often more useful than the command itself.

Which signals usually separate abuse from routine maintenance

The most reliable indicators are usually contextual anomalies, not exotic payloads. Unexpected source hosts, unusual command sequences, abnormal privilege use, repeated remote logins, and tools running in environments where they are not normally needed are all strong signals. In OT, the same is true for reconnaissance-like use of standard utilities, especially when they appear before a process change, restart, or configuration edit.

Detection becomes more practical when teams watch for session anomalies as well as command anomalies. A legitimate utility can still be abused if the session comes from a different host, at an odd time, or under an account with broader privilege than the task requires. That is why the best detections combine host, account, time, and asset context instead of alerting on one field alone.

For teams building OT detections and response workflows, an OT Security Platform Buyer's Guide is useful for evaluating passive discovery and protocol visibility, while OT Incident Response Guide helps translate suspicious living-off-the-land activity into containment choices that do not disrupt safety or operations.

Risk and Threat Considerations

Living off the land in ot is risky because it lets an intruder blend into approved operational activity. When detection relies only on malware signatures or obvious exploits, adversaries can use native tooling, remote management channels, and maintenance utilities to stay inside the normal noise of plant operations. That increases dwell time and makes it harder to separate an operator action from an attacker action.

Failure mechanism: The attacker abuses trusted tools, approved remote paths, or maintenance workflows so the activity inherits legitimacy from the environment rather than from the actor.

Impact: Security teams can miss reconnaissance, lateral movement, unauthorized command execution, or pre-positioning inside OT zones until the activity affects availability, integrity, or safety.

Practitioner Guidance

What to verify: Confirm that every remote admin utility, scripting tool, and maintenance account has an owner, an allowed host list, and a defined use window. If you cannot tie a session to a ticket, a normal workstation, and an approved change, treat it as a detection event rather than routine support activity.

Decision rule: If a legitimate tool is seen in an unexpected OT context, prioritize attribution and blast-radius assessment before asking whether the command was technically allowed. In OT, the same tool can be harmless, high risk, or outright hostile depending on where and how it was used.

Practitioner takeaway: The key skill is not spotting unfamiliar binaries, but proving whether familiar tools are being used inside the expected operational story, because that is where living-off-the-land activity hides.

Related resources from NHI Mgmt Group

• How should security teams detect living-off-the-land attacks in hybrid environments?
• How should security teams detect living off the land abuse of CertUtil in Windows environments?
• How should security teams detect and block living off the land malware that abuses signed Windows utilities to load payloads?
• How should security teams stop living-off-the-land attacks after a valid login?