Living off the Land: Attacks That Use Your Own Tools Against You

The 30-second explanation

Instead of sneaking in with a crowbar, the burglar uses the toolbox already in your garage. Nothing looks unusual because the tools are yours.

How it works

1. 1

   1. Get access

   A stolen login or a phishing foothold.

2. 2

   2. Use native tools

   Built-in shells and admin features.

3. 3

   3. Blend in

   Actions look like routine administration.

4. 4

   4. Move on

   Spread and collect using the same tools.

Security tools are good at recognising known malicious files. Attackers who use tools already on the machine avoid dropping anything to recognise. The tools themselves are legitimate, so the signal is in context: who ran it, from where, at what time, and what happened next. This is why behavioural detection and good baselines matter more than file scanning against this style of attack.

Real-world example

How to spot it

• Admin tools from ordinary users

  Powerful features used by accounts that never use them.

• Odd parent processes

  A document or browser launching a shell.

• Encoded or hidden commands

  Long, obscured command lines.

• Tools used at odd times

  Normal tools, unusual hours or hosts.

What to do

1. 1Log command-line activity and script execution, so the context is visible.
2. 2Restrict which accounts can use powerful native tools, and remove features nobody needs.
3. 3Baseline normal administrative activity so deviations stand out.