A living off the land (LotL) attack is a technique in which attackers use legitimate tools already installed on a system, such as PowerShell, WMI (Windows Management Instrumentation) or certutil, instead of deploying their own malware. Because these tools are trusted, traditional antivirus rarely blocks them, so detection depends on spotting abnormal behavior, like an office PC running encoded PowerShell commands at night.
How TecnetOne handles it: TecnetSOC
LotL, LOLBins, LOLBAS, living off the land binaries, fileless attack, dual-use tools
Related terms
Prompt injection
Prompt injection is an attack against AI applications built on large language models (LLMs) that slips in malicious instructions so the model ignores its rules. It can be direct, typed by the user, or indirect, hidden in an email, document or web page the assistant processes, and it can lead to data leaks or unauthorized actions such as sending files or messages.
MFA fatigue
MFA fatigue is an attack in which someone who already has a victim's password sends repeated multi-factor authentication (MFA) approval requests to their phone until the person accepts one out of frustration or confusion. It is also called MFA bombing or push bombing. It is mitigated with number matching, attempt limits and phishing-resistant methods such as passkeys.
Double and triple extortion
Double extortion is a ransomware tactic in which attackers steal a copy of the data before encrypting it and threaten to publish it if the company does not pay. Triple extortion adds a third form of pressure, such as distributed denial-of-service (DDoS) attacks or direct messages to the victim's customers and partners. Backups alone do not remove the risk of a data leak.
Credential theft
Credential theft is the unauthorized capture of usernames, passwords, tokens or session cookies so an attacker can sign in to systems as a legitimate user. It happens through phishing, infostealer malware, keyloggers or breaches of other services. For example, a corporate email password entered on a fake login page can give access to Microsoft 365 without installing any malware.
Quishing
Quishing is a form of phishing that uses a QR (quick response) code to send the victim to a fake website that steals credentials or installs malware. Because the link is hidden inside an image, it evades many email filters and is opened on a phone, outside company security controls. For example, an email with a QR code asking the user to renew multi-factor authentication.
Ready to put this into practice in your operation?
Tell us what you need and a TecnetOne engineer will get back to you.
Talk to an engineerTalk to an engineer
Tell us what you need and we’ll reply the same business day.