LotL

Living off the Land describes attackers using legitimate tools already installed on a system, such as PowerShell or administrative utilities, instead of dropping custom malware. Because the activity blends in with normal administration, it is much harder for antivirus and monitoring tools to flag. Nation-state groups have used LotL techniques to persist undetected in critical infrastructure for long periods.