Draft:Living-off-the-Land attack

• Comment: A patchwork of minimal paraphrasing from the sources. In addition to the copyvio/plagiarism problem, it also creates some rather awkward wording such as "This in turn makes it quite confusing for the defenders on the network to segregate between an authentic user’s activity and the same user engaging in a malicious activity", cf the source's phrasing "this makes it difficult for network defenders to discern legitimate behavior from malicious behavior [...]" (page 2 in the source) bonadea contributions talk 11:46, 14 September 2024 (UTC)

• Comment: This crosses between WP:NOTHOWTO and WP:NOTESSAY. In addition, most of the sources are not reliable (blogs, WP:FORBESCON, commercial sites, conference proceedings, etc.). If resubmitted without substantial improvement with both the content and sourcing, the draft may be rejected meaning it will not longer be considered. S0091 (talk) 21:56, 9 September 2024 (UTC)

• Comment: Still contains WP:NPOV and tone issues, with some brand new questionable sentences. "By combining these approaches, organizations can strengthen their defense against LOTL attacks and reduce the likelihood of undetected system compromises.", which independent, reliable source asserts this? Utopes _{(talk / cont)} 06:34, 9 September 2024 (UTC)

• Comment: This currently reads like a "PSA announcement" on avoiding "living off the land" attacks, when it should be written like an encyclopedia article and fully described like so. The sourcing is also insufficient, which independent reliable source states that: "These actions taken together enhance the overall capability of the organization to defend and to recover from LOTL threats."? Utopes _{(talk / cont)} 21:25, 8 September 2024 (UTC)

---

Living-Off-the-Land (LOTL) refers to a fileless malware cyberattack technique whereby the threat actors utilize the available system tools and built-in system features to compromise the networks while remaining undetected . Unlike traditional types of cyber assaults with a malware infection, in this case, the attacker does not import external malware into the systems . Instead, cybercriminals use the inbuilt utilities and administrative options available making it hard even for the traditional security features to pick them out.

Attack tools

Several legitimate system utilities are commonly employed in LOTL attacks, and these tools, which are integral to operating system functionality or administrative processes, can be misused to execute malicious actions. Some of the most frequently exploited software include :

• VB scripts
• PowerShell scripts
• netsh commands
• The task scheduler
• the WMI command line (WMIC)

Detection and prevention techniques

Advanced monitoring techniques, such as behavior analysis and machine learning are used to identify unusual system activity that may indicate an ongoing LOTL attack

Several strategies for prevention include:

• Implement Process Detection Rules: Apply detection rules to identify suspicious processes such as PowerShell and Command Prompt triggered by Microsoft Office applications.
• Leverage Advanced Tools: Engage in endpoint monitoring and conduct behavioral analytics to respond to suspicious acts.
• Use User & Entity Behavioral Analytics: Build or acquire automation (such as machine learning models) to continually review all logs to compare current activities against established behavioral baselines and alert on specified anomalies.
• Least Privilege Principle: Grant users only the minimum privileges necessary to perform their job duties .