Cybersecurity Glossary
Living off the Land
Attacks carried out with the legitimate tools already present on your systems.
What Living off the Land means
Rather than installing malware that antivirus might catch, the attacker uses built in administrative tools: scripting engines, remote management utilities, backup software. Everything they run is signed, legitimate and normally present, which makes the activity difficult to distinguish from routine administration.
Why Living off the Land matters for small businesses and nonprofits
This is why file scanning alone is no longer adequate. Detection depends on noticing that a legitimate tool is being used by an unusual account, at an unusual time, in an unusual way.
What to do about Living off the Land
- Restrict who may run scripting and remote administration tools
- Log command line activity, not just file changes
- Use detection that scores behaviour rather than matching known files
Not sure where you stand on this?
We review your current setup against the basics, tell you plainly what is covered and what is not, and give you a ranked list with effort and cost. No jargon and no scare tactics.