September 19, 2026 Post by : Editorial Threat Intelligence

There is a certain comfort in the idea of malware. It feels concrete. You can hash it, name it, block it, and write a rule that says "if this file shows up, sound the alarm." But a growing share of intrusions never bother with a malicious binary at all. Instead, attackers log in with stolen credentials and use the tools that are already installed on the machine: PowerShell, WMI, PsExec, certutil, bitsadmin, and a long list of other legitimate utilities. This approach is usually called living off the land, and it is one of the harder problems in modern detection.

The reason it works is simple. These tools exist for a reason. Administrators use them every day. If you write a detection rule that fires every time PowerShell runs, you will drown in false positives before lunch. If you write one that never fires on PowerShell, you have handed attackers a free pass. The entire game becomes context: who ran it, from where, with what arguments, and what happened next.

Why Signature-Based Thinking Falls Short

Most security programs start with signatures because they are cheap and they work against commodity threats. A known ransomware strain has a known hash. A phishing payload has a known URL. But living-off-the-land activity has no hash to match. The binary is signed by Microsoft. The command line might look almost identical to something a help desk technician ran last week.

This is where behavior enters the picture. A single PowerShell invocation tells you very little. A PowerShell invocation that spawns from an Office document, reaches out to an unfamiliar external IP, downloads a script, and then creates a scheduled task tells you a great deal. The signal is not the tool. The signal is the sequence.

Building that kind of detection requires logging that many organizations already have but rarely use well. Process creation events, command-line arguments, parent-child process relationships, and network connections all matter. The problem is volume. A mid-sized company can generate millions of process events a day, and most of them are uninteresting. The work is in tuning, not in collecting.

It also helps to know your own environment. If your finance team never opens a command prompt, a command prompt on a finance workstation is interesting. If your developers run scripts all day, the same event is background noise. Generic threat intelligence feeds cannot tell you that. Your own baseline can.

Practical Steps Without Buying a New Platform

You do not need a massive budget to start. You need a handful of high-value detections and the discipline to maintain them. Office applications spawning command shells is a classic. So is a workstation suddenly making SMB connections to other workstations. So is a service account logging in interactively at 3 a.m. None of these are proof of compromise on their own, but together they form a picture.

It also helps to limit the blast radius before you need to. Removing local admin rights from everyday users, restricting which accounts can use remote management tools, and enabling PowerShell script block logging all raise the cost for an attacker who wants to stay quiet. None of these are glamorous. All of them work.

The uncomfortable truth is that living-off-the-land attacks are not going away. They are efficient, they blend in, and they survive most antivirus products without breaking a sweat. The defenders who handle them best are not the ones with the biggest tool stack. They are the ones who understand what normal looks like on their own network, and who notice when it stops being normal.

• Share:

Back to blog

Small Business Owners Make it Happen in 2025

Small Business Owners Make it Happen in 2025