In an era where cybersecurity threats continuously evolve, organizations face many challenges to secure digital assets. Among these threats, a sophisticated and stealthy approach known as Living Off the Land (LotL) attacks has emerged, leaving a minimal footprint and often evading traditional security measures.
This article discusses Living Off the Land attacks, highlighting real-world case studies from notorious APTs, and offering suggestions on how organizations can address these threats.
What Is “Living off the Land” in Cybersecurity?
“Living off the land” (LotL) describes a strategy employed by attackers where they utilize the tools, software, and resources already available on the target system for malicious purposes rather than deploying outside malware that may be detected.
LotL tactics typically have a few core features:
- Utilizing Built-in Tools and Features: Attackers leverage existing, legitimate tools and features the operating system provides to carry out their activities. Standard tools misused include PowerShell, Windows Management Instrumentation (WMI), and various system administration tools.
- Reduced Detection: Since the attackers are using legitimate tools that are supposed to be on the system, their activities are more challenging to detect. Unlike malware or foreign tools, which security solutions could flag, the misuse of legitimate tools often goes unnoticed.
- Scripting and Automation: Attackers often use scripts and automation to carry out malicious activities using the existing tools on the system. This could also include using macros and scripts in office documents to execute malicious commands.
- Fileless Attacks: “Living off the land” tactics often align with fileless attack methodologies, where the attack is carried out in memory, without writing any files to disk, further reducing the footprint and increasing the chances of evading detection.
- Dual-use Tools: Attackers may also utilize dual-use tools, which have legitimate uses but can also be used maliciously. Examples include remote administration tools or network scanning utilities.
- Reduced Attribution: It can be more difficult to attribute attacks carried out using “living off the land” tactics since the attackers are not deploying unique malware that could be tied back to them.
- Resource Efficiency: By using the existing resources on the target system, attackers can save time and effort in developing and deploying their tools or malware.
Who Uses Living of the Land Techniques?
The technique of “living off the land” (LotL) is used by various attackers, particularly those involved in targeted and sophisticated cyber-attacks.
Various targeted attack groups have been seen utilizing LotL tactics. This approach allows them to blend their malicious activity with legitimate administrative work on the target system, making their operations harder to detect and attribute.
A report by CrowdStrike mentioned that 62% of attackers used LotL tools or techniques in their attacks, indicating a widespread adoption of this strategy among cyber attackers. Additionally, specific threat actors like the Volt Typhoon have been reported to focus heavily on LotL techniques to maintain stealth while targeting critical infrastructure in the United States.
Examples Where LotL Techniques Were Used
Volt Typhoon
Volt Typhoon, a state-sponsored cyber actor associated with the People’s Republic of China, utilized LotL techniques extensively in its cyber operations. The actor leveraged built-in network administration tools on target systems to perform its objectives. This approach helped the actor to evade detection by blending in with regular Windows system and network activities, avoiding endpoint detection and response (EDR) products that would alert on the introduction of third-party applications, and limiting the amount of activity captured in default logging configurations.
Some of the built-in tools used by Volt Typhoon include wmic, ntdsutil, netsh, and PowerShell?.
APT29
APT29 is known for using stealthy backdoors like POSHSPY, which leverages built-in Windows features such as PowerShell and Windows Management Instrumentation. POSHSPY extensively used WMI to store and persist the backdoor code, making it invisible to non-experts in WMI.
The backdoor ensured that only legitimate system processes were utilized by PowerShell, and malicious code execution could only be identified through enhanced logging or in memory. APT29 deployed POSHSPY as a failover backdoor if they lost access to their primary backdoors.
Mandiant initially identified an early variant of the POSHSPY backdoor deployed as PowerShell scripts during an incident response engagement in 2015. The methodology adopted by APT29 for this backdoor exemplifies a fileless approach, making identifying the backdoor much more challenging using standard host analysis techniques.
How You Can Recognize and Address LotL Techniques
Recognizing and mitigating Living Off the Land (LotL) techniques can be challenging due to their inherent nature of blending with legitimate activities.
However, organizations can adopt a multi-faceted approach to deal with such threats effectively:
- Enhanced Logging and Monitoring: Enable and configure advanced logging mechanisms to capture detailed system and network activities. Monitor system logs for unusual behavior patterns, especially focusing on the misuse of built-in tools like PowerShell, WMI, and others. Utilize security information and event management (SIEM) systems to correlate data and identify suspicious activities.
- Behavioral Analysis: Employ tools that identify abnormal patterns based on historical data and known benign behavior. Monitor for unexpected, high-volume command-line or script activity, especially during odd hours.
- Endpoint Detection and Response (EDR) Tools: Implement EDR tools to monitor endpoints for suspicious activities, including the misuse of legitimate tools and scripts. Some EDR solutions can identify malicious activities by analyzing the behaviors and context in which built-in tools are used.
- Educate and Train Staff: Educate staff on the risks associated with LotL techniques and train them to recognize potential signs of misuse. Encourage reporting of unusual system behavior and provide clear reporting channels.
- Regular Auditing and Review: Review system and network configurations to ensure they adhere to best practices. Audit user accounts and privileges to ensure that only necessary permissions are granted.
- Application Whitelisting: Implement whitelisting to control the execution of scripts and applications on the network. This can help prevent the execution of malicious scripts, even if they are leveraging built-in tools.
- Threat Hunting: Engage in proactive threat hunting to identify signs of LotL techniques before they can cause significant damage. Utilize threat intelligence feeds to stay updated on new LotL techniques and indicators of compromise (IoCs).
- External Assistance: Consult with external cybersecurity experts or firms that identify and mitigate LotL techniques. Participate in information sharing and analysis centers (ISACs) to share and receive threat intelligence related to LotL techniques.
- Patch Management: Keep systems, applications, and security solutions up to date to minimize vulnerabilities that could be exploited using LotL techniques.
- Zero Trust Architecture: Adopt a Zero Trust architecture that requires verification at every step, regardless of whether the activity appears to be originating from within the network. Combining these measures can significantly enhance an organization’s ability to recognize and mitigate the risks associated with Living Off the Land techniques.
Monitor and Assess Your IT System with Lazarus Alliance
Living off the land attacks epitomize the stealth and sophistication that modern-day cyber adversaries employ to infiltrate and persist within target networks. These attacks exploit the very tools and features intended to manage and safeguard our digital environments. That’s why having a partner like Lazarus Alliance is essential to help manage and monitor your critical IT infrastructure.
[wpforms id=”137574″]