Latest / Cybersecurity Business with Fexingo: Security Companies, Breaches, and Enterprise Defense / Why Attackers Are Using Living Off the Land Techniques
Transcript
- Lucas: If these conversations are useful for what you're building or running, you've probably noticed we don't chase ad revenue on this show. The model is simpler — listener support keeps it ad-free. Luna: And we'd rather keep it that way. No mid-rolls, no sponsors reading scripts about things they don't use. Lucas: So if today's episode helps you think about a security problem differently, consider tossing a few dollars into the tip jar — buy me a coffee dot com slash fexingo. That's it. No tiers, no perks, just keeping this sustainable. Luna: And we appreciate every single one. Now, Lucas, you were saying about living off the land? Lucas: Right. So the reason I wanted to talk about living off the land — LotL for short — is that it flips the old assumption that attackers always bring their own malware. Increasingly, they don't. They just use what's already on the machine. Luna: And by 'what's already on the machine,' you mean things like PowerShell, WMI, maybe mshta? Lucas: Exactly. PowerShell, Windows Management Instrumentation, the Windows command shell, bitsadmin, certutil — these are trusted admin tools. They're signed by Microsoft. They're whitelisted by default in most enterprise environments. So when an attacker runs a PowerShell script to download a payload, it looks like an admin doing admin work. Luna: And that's what makes it so hard for traditional antivirus or even some endpoint detection tools, right? Because the binary itself is clean. Lucas: Right. The file hash is Microsoft's. It's not flagged as malicious. The behavior is what's malicious — but distinguishing that from legitimate admin activity is the hard part. Let me give you a concrete example from earlier this year. A mid-sized financial services firm in Chicago — I'll keep it anonymous — lost two point three million dollars in a wire fraud scheme. The attacker got in via a phishing email, but the actual fraud was executed using Windows Remote Management and PowerShell. They never dropped a single executable. They just used WinRM to move laterally, PowerShell to scrape credentials from memory, and then initiated wires from a compromised finance workstation. Luna: So the security team probably saw PowerShell.exe connecting to an external IP and thought, 'well, that's weird,' but didn't have the context to know it was malicious. Lucas: Exactly. And that's the challenge. CrowdStrike's 2025 Global Threat Report — which came out in February — found that seventy-one percent of all attacks now involve some form of LotL technique. That's up from about sixty percent the year before. So it's not a fringe tactic anymore; it's the mainstream. Luna: Seventy-one percent is massive. And I imagine it's even higher in ransomware cases, because they need to move fast and avoid detection. Lucas: That's right. In ransomware incidents, the number jumps to nearly eighty-five percent. The ransomware groups — BlackCat, LockBit, Clop — they all have LotL components in their playbooks. They use PowerShell for reconnaissance, WMI for lateral movement, and often BITSAdmin for exfiltration because it looks like legitimate Windows update traffic. Luna: So what's the defense? If you can't block the tools themselves because your admins need them, what do you do? Lucas: That's the million-dollar question. And there's no single answer, but the direction most mature security teams are moving in is behavior-based detection. Instead of saying 'block PowerShell,' which breaks half your IT automation, you say 'alert when PowerShell makes an outbound network connection to an unknown IP and then writes a file to the startup folder.' That's a specific behavioral signature. Luna: So it's more about baselining what normal looks like and then flagging deviations. Lucas: Exactly. And that's where modern endpoint detection and response platforms have gotten much better. They use machine learning models trained on billions of events to distinguish between, say, a sysadmin running a PowerShell script to deploy software and an attacker running a PowerShell script to dump credentials. But it's not perfect — there are still false positives, and skilled attackers know how to slowly ramp up activity to stay under the threshold. Luna: I've also seen some organizations using application control — like Microsoft's AppLocker or WDAC — to only allow signed scripts or scripts from specific locations. Lucas: That's a good layer. Windows Defender Application Control can restrict PowerShell to Constrained Language Mode, which breaks most offensive PowerShell tools. But it's a pain to deploy at scale, and some legacy applications break. The trade-off is real. Luna: So what's the one thing you'd tell a CISO who's worried about LotL but doesn't know where to start? Lucas: I'd say start with visibility. You can't defend against what you can't see. Deploy an EDR tool that specifically logs process command lines, network connections, and parent-child process relationships. Then look for the common LotL patterns: PowerShell launching from Microsoft Office, rundll32 without a DLL, regsvr32 executing a script from a remote server. Those are huge red flags. Luna: And I'd add: disable the tools you don't need. Do your developers really need PowerShell on their workstations? Probably not. Do your finance people need Windows Script Host? No. Least privilege applies to binaries too. Lucas: That's a great point. And there's a practical angle with cyber insurance, too. A lot of insurers are now asking specifically about LotL defenses in their underwriting questionnaires. If you can show you have PowerShell logging enabled and monitored, you might get a better premium. Luna: So it's not just a technical issue; it's a business risk issue now. Lucas: Exactly. And that's why I think every security team should spend at least a few hours understanding the LotL toolkit. It's not going away — attackers love it because it works. And as defenses improve, they'll just find new built-in tools to abuse. Luna: Well, that's a sobering thought. But at least now we know what to look for. Lucas: Right. And that's the whole point — awareness is the first defense. Thanks for listening.