Living off the Land

Description

Includes PowerShell, certutil, mshta, regsvr32, rundll32, and other Windows tools.

Hampers detection because signed system binaries are used.

Does not require downloading additional malware — uses what is already on the system.

Documented on the LOLBAS project with hundreds of known abusable tools.

Examples

• certutil for downloading malware from the internet
• mshta for executing HTA files with malicious scripts

Notes

• Often combined with fileless execution technique.