Which term or expression is utilized when adversaries leverage existing tools in the environment?

In cybersecurity, the term"Living off the land" (LOTL)refers to adversaries using legitimate tools and software that are already present within a target’s environment to conduct malicious activity. This approach allows attackers to avoid detection by using trusted applications instead of bringing in new, suspicious files that might be flagged by endpoint security solutions.

Definition and Usage Context"Living off the land" is a method that leverages tools, utilities, and scripting environments typically installed for administrative or legitimate purposes. Attackers prefer this approach to minimize their visibility and avoid triggering endpoint detection mechanisms that rely on recognizing foreign or malicious executables. Tools like PowerShell, Windows Management Instrumentation (WMI), and command-line utilities (e.g., cmd.exe) are frequently employed by attackers using this strategy.

Tactics in Endpoint Security Complete ImplementationWithin anEndpoint Security Completeimplementation framework, LOTL is specifically recognized in contexts where endpoint solutions need to monitor and distinguish between legitimate use and misuse of standard administrative tools. This approach is often documented in theDetection and Prevention phasesof Endpoint Security Implementation, where specific focus is given tomonitoring command-line activities,auditing PowerShell usage, andidentifying anomalous behaviortied to these tools.

Impact and MitigationLOTL can complicate detection efforts because security solutions must discern between legitimate and malicious uses of pre-existing tools.Symantec Endpoint Security Completecounters this by using behavior-based analysis, anomaly detection, and machine learning models to flag unusual patterns, even when no new files are introduced.

Relevant References in SES Complete DocumentationDetailed guidance on addressing LOTL tactics within Symantec Endpoint Security Complete is often found in the documentation sections coveringThreat Hunting and Behavior Analytics. These resources outline how the platform is designed to flag suspicious usage patterns within native OS tools, leveraging telemetry data and known indicators of compromise (IoCs) for early detection.