# What is Living off the Land (LOTL)?

> Living off the land (LOTL) is attacker tradecraft that abuses legitimate software, built-in system utilities, administration features, credentials, or trusted services to perform malicious actions.

- Canonical URL: https://yellowcube.eu/glossary/living-off-the-land/
- Publisher: Yellow Cube
- Language: en
- Contact: hello@yellowcube.eu

## Content

Because the same capabilities support routine operations, LOTL activity can blend into expected behavior and bypass controls focused on unfamiliar binaries. The term describes how capabilities are sourced, not a malware family or one specific technique.

LOTL can support discovery, execution, persistence, credential access, lateral movement, collection, or command and control. The capability may be built in, cloud-provided, or legitimate dual-use software. It may access files or accompany custom malware, so LOTL does not mean artifact-free.

### Key points

- **Context is central:** A tool name alone rarely establishes intent. Analysts need the initiating identity, parent process, command purpose, target, timing, authorization, and expected administrative pattern.
- **Detection approach:** Combine process, identity, command-line, script, network, and cloud audit evidence; baseline legitimate administration; and investigate unusual sequences or use from unexpected accounts and hosts.
- **Exposure reduction:** Limit administrative tools and remote-management paths to defined roles, use application control where appropriate, protect privileged accounts, and retain the telemetry needed to reconstruct activity.
- **Important limitation:** Blocking every dual-use utility can disrupt legitimate operations and still leave equivalent capabilities available. Allowing a trusted or signed tool globally is also unsafe; trust in the software does not authorize every use.

### Related terms

[Fileless malware](<https://yellowcube.eu/glossary/fileless-malware/>) · [Malware](<https://yellowcube.eu/glossary/malware/>) · [Lateral movement](<https://yellowcube.eu/glossary/lateral-movement/>) · [Command and control (C2)](<https://yellowcube.eu/glossary/command-and-control/>) · [Endpoint security](<https://yellowcube.eu/glossary/endpoint-security/>)

### Sources

[CISA and partners: Identifying and Mitigating Living Off the Land Techniques](https://www.cisa.gov/sites/default/files/2025-03/Joint-Guidance-Identifying-and-Mitigating-LOTL508.pdf) · [MITRE ATT&CK T1218: System Binary Proxy Execution](https://attack.mitre.org/techniques/T1218/)

## Attribution and scope

This Markdown representation is generated from the same approved content records as the canonical HTML page. Cite the canonical URL above when referencing this material. Product and service descriptions are informational; confirm project-specific requirements with Yellow Cube.