The binary can be trusted while the behavior is hostile. Attackers repurpose tools already present on a system so execution looks like administration until command context, lineage, and destination tell the full story.
A living-off-the-land binary can be Microsoft-signed, installed by default, and commonly allowed by application controls. Those properties make the file useful to defenders and attackers at the same time.
The durable signal is behavioral: which parent started it, which arguments were supplied, what child process appeared, what network destination it reached, and whether that pattern belongs on that asset.
Native tools are already present, so an attacker can move from a document or browser session into execution without writing a conspicuous new executable. Signed tools may also inherit firewall, application-control, or analyst trust that custom binaries would not receive.
This does not make living-off-the-land invisible. It shifts detection from file reputation toward command-line telemetry, process relationships, script logging, network behavior, and cross-host rarity.
| Capability | Examples | High-signal question |
|---|---|---|
| Proxy execution | rundll32, regsvr32, mshta | Is a signed host loading script, a remote object, or an unexpected export? |
| Script execution | PowerShell, wscript, cscript | Is the script encoded, hidden, downloaded, or spawned from a document? |
| Transfer and decode | certutil, bitsadmin | Is a utility retrieving or decoding content outside its normal management workflow? |
| Discovery | whoami, net, nltest | Do multiple discovery commands form a burst after initial access? |
One PowerShell process is not a detection. A document spawning mshta, followed by hidden PowerShell, followed by a logon task is a sequence. Each edge adds context and increases confidence.
Good rules preserve that sequence and use narrow exclusions tied to an approved path, signer, service account, and change window. Broad allowlists for every signed tool recreate the blind spot the attacker selected.
| FoylGuard EDR | Inspect process lineage, command lines, signer state, and persistence artifacts. |
| Process Tree Hunt | Find the exact edge where signed-tool use becomes malicious. |
| Sigma Builder | Turn the behavior into portable detection logic. |
| Account Takeover Response | Investigate SILENT DELEGATE from identity theft into endpoint execution. |