Quick answer: You cannot blocklist living-off-the-land binaries (LOLBins), because they are signed Windows tools your administrators use every day, so you detect their abnormal use instead. Turn on process creation logging with command lines (Windows event 4688 or Sysmon event 1), PowerShell script block logging (event 4104) and a handful of Sysmon events, baseline how each sensitive tool is normally used, and alert on an unusual parent process, path, destination or sequence. Then prove the detections fire with a red or purple team exercise mapped to MITRE ATT&CK v20. The matrix below gives the telemetry and the detection logic for 16 commonly abused binaries and techniques.
The data says this is where intrusions live now. CrowdStrike's 2026 Global Threat Report found 82% of 2025 detections were malware-free, with an average eCrime breakout time of 29 minutes and the fastest at 27 seconds. Red Canary's 2026 Threat Detection Report, built on more than 110,000 confirmed threats across 1,700 organizations in 2025, ranks PowerShell #2, the Windows Command Shell #3, Ingress Tool Transfer #5 and Windows Management Instrumentation #7 among all techniques. And Sophos's 2026 Active Adversary Report, drawn from 661 cases handled between November 2024 and October 2025, found Microsoft binaries in its attacker-tools data up 19% year on year, with only two of the 30 most-observed binaries changing from the year before.
That last point is the useful one for defenders: the abused toolset is stable, so a detection matrix built for it keeps paying off. This post is written for SOC leads, detection engineers and threat hunters. It explains the abuse in plain words only, never with commands, and spends its length on telemetry, detection logic and validation. It is a companion to our wider guide to EDR evasion in 2026, which treats LOTL as one of four evasion categories.
TL;DR
Malware-free is the norm (2025): 82% of CrowdStrike detections involved no malware (CrowdStrike 2026 Global Threat Report).
The abused tools barely change (Nov 2024 to Oct 2025): only two of Sophos's 30 most-observed binaries differed from the prior year (Sophos 2026 Active Adversary Report).
Native scripting ranks just behind cloud accounts (2025): PowerShell and the Windows Command Shell rank #2 and #3 across 110,000+ confirmed threats (Red Canary 2026).
The catalogs are large (October 2026): the LOLBAS project lists 245 Windows entries, GTFOBins 478 Unix binaries and LOOBins 76 macOS binaries (LOLBAS, GTFOBins, LOOBins).
ATT&CK moved under your mappings (2026): v19 split Defense Evasion into Stealth and Defense Impairment, and log clearing moved from T1070.001 to T1685.005; v20 shipped on 13 October 2026 (MITRE ATT&CK).
Detection is behavioral, and it must be tested: the CISA-led joint guidance tells defenders to baseline activity and automate comparison against it, and not to block LOLBins "indiscriminately" (CISA joint guidance).
What changed in 2026
Five developments from 2026 affect how you build and map LOTL detections.
Change | Date | What it means for your detections |
|---|---|---|
MITRE ATT&CK v19 split the Defense Evasion tactic into Stealth (TA0005) and Defense Impairment (TA0112) | 28 April 2026 | System Binary Proxy Execution (T1218) now sits under Stealth. Impair Defenses was revoked into T1685 Disable or Modify Tools, and Clear Windows Event Logs is now T1685.005 (previously T1070.001). Re-map rules and coverage heatmaps that still use the old IDs. |
MITRE ATT&CK v20 released | 13 October 2026 | Enterprise now has 227 techniques and 479 sub-techniques. The IDs in the matrix below are current as of v20; T1218 still lists 14 sub-techniques and lists Linux and macOS as platforms alongside Windows. |
Windows 11 gained built-in Sysmon as an optional feature | 24 February 2026 (KB5077241) | Microsoft states that built-in Sysmon "is off by default" on Windows 11 24H2 and 25H2. It removes a deployment hurdle, not the need to enable and configure it (Microsoft). |
Sophos 2026 Active Adversary Report | 2026 (data Nov 2024 to Oct 2025) | Microsoft binaries up 19% year on year in its tools data; compromised credentials were the top root cause at 42.06%; internal RDP use appeared in 66% of cases (Sophos). |
Red Canary 2026 Threat Detection Report | 2026 (2025 data) | Cloud Accounts took #1, but PowerShell, the Windows Command Shell, Ingress Tool Transfer and WMI all stayed in the top seven (Red Canary). |
What living off the land means
Living off the land is the practice of reaching attacker goals with the legitimate tools already on a system instead of custom malware. The tools are called LOLBins, and the community LOLBAS project catalogs them for Windows. In October 2026 its repository held 245 entries: 136 binaries that ship with Windows, 82 other Microsoft-signed binaries, 17 libraries and 10 scripts, each documenting what the file can be repurposed for and the ATT&CK techniques involved (LOLBAS on GitHub). The Unix and macOS equivalents are GTFOBins (478 binaries) and LOOBins (76 binaries).
MITRE gives the core behavior a formal home. System Binary Proxy Execution (T1218) describes how adversaries "bypass process and/or signature-based defenses by proxying execution of malicious content with signed, or otherwise trusted, binaries", and lists 14 sub-techniques including Rundll32, Mshta, Regsvr32 and Msiexec. Government incident response shows how far it goes: in advisory AA24-038A (7 February 2024), CISA, NSA, FBI and partners reported that Volt Typhoon held footholds in some victim IT environments for "at least five years", relying on built-in tools such as ntdsutil, wmic, netsh, vssadmin and PowerShell.
The economics explain the growth. LOTL needs no malware development, leaves few scannable artifacts, and pairs naturally with stolen credentials. Once an adversary holds a valid account and uses trusted tools, most controls see a busy administrator.
Why you cannot blocklist LOLBins
The February 2024 joint guidance Identifying and Mitigating Living Off the Land Techniques, authored by CISA, NSA and FBI with the US Department of Energy, EPA and TSA and the Australian, Canadian, UK and New Zealand cyber centres, sets out four structural reasons.
The tools are required. The guidance says that because administrators use these tools for legitimate functions, "network defenders should not block or limit their use indiscriminately." Blocking cmd.exe, PowerShell or Remote Desktop wholesale breaks administration the same afternoon.
Trust checks answer the wrong question. A LOLBin is Microsoft-signed and genuine, so signature validation, allowlisting and hash reputation all pass it. MITRE notes that binaries signed with trusted certificates "can typically execute on Windows systems protected by digital signature validation." The check confirms the tool is trusted, not that this use of it is benign.
There is no indicator to match. The guidance states "There is a general lack of conventional indicators of compromise (IOCs) associated with the activity," and adds that attackers can easily change the filenames, arguments and hashes that indicator lists rely on.
Default logging misses it. Defenders often "Rely predominantly on untuned endpoint detection and response (EDR) systems, which may not alert to LOTL activity", "Maintain default logging configurations, which do not comprehensively log indicators of LOTL techniques", and "Have difficulty in identifying a relatively small volume of malicious activity within large volumes of log data."
The answer is to stop asking what the file is and start asking what the process does: which parent launched it, with what arguments, toward which destination, and in what sequence.
The LOTL detection matrix (ATT&CK v20)
This is the core of the post. Each row names the binary or technique, its ATT&CK v20 ID, the abuse pattern in plain words, the telemetry you need, and the behavioral logic that separates abuse from administration. "Sysmon 1" means Sysmon event ID 1; four-digit IDs are Windows Security log events unless noted. Treat the logic as a starting point and tune it against your own baseline.
Binary or technique | ATT&CK v20 | Abuse pattern | Telemetry needed | Detection logic (plain words) |
|---|---|---|---|---|
powershell.exe | T1059.001 PowerShell | Runs script content that is encoded, obfuscated or pulled from the internet, often launched by a document or browser | Script block logging 4104; process creation 4688 with command line or Sysmon 1; network Sysmon 3 | Alert when Office, a browser, a mail client or a script host is the parent; when script content is encoded or obfuscated; or when PowerShell on a host or account that rarely uses it makes a first-seen outbound connection |
cmd.exe | T1059.003 Windows Command Shell | Runs chained commands, often spawned by a web server, an Office document or a service | 4688 or Sysmon 1 | Alert when a web server worker, Office app or database service spawns cmd.exe; score bursts of chained commands from one parent within minutes |
wmic.exe and WMI | T1047 Windows Management Instrumentation | Starts processes on remote hosts and sets up persistence through WMI event subscriptions | 4688 or Sysmon 1 (parent WmiPrvSE.exe); Sysmon 19, 20 and 21 | Alert when WmiPrvSE.exe spawns a shell or script engine, and on any new permanent WMI filter, consumer or binding outside a change window |
rundll32.exe | T1218.011 Rundll32 | Runs code from a DLL in a user-writable folder, or calls a Windows DLL export to read credential memory | 4688 or Sysmon 1; image load Sysmon 7; process access Sysmon 10; network Sysmon 3 | Alert on DLLs loaded from user-writable or temp paths, on rundll32 with no DLL argument, on outbound connections, and on any rundll32 access to lsass.exe |
mshta.exe | T1218.005 Mshta | Runs HTML application script, often fetched from a remote location | 4688 or Sysmon 1; Sysmon 3 | Most estates never use it, so alert on any execution outside a short allowlist, especially from an Office or browser parent or followed by a network connection |
regsvr32.exe | T1218.010 Regsvr32 | Loads a script component or DLL, sometimes straight from a remote address | 4688 or Sysmon 1; Sysmon 3; Sysmon 7 | Alert on regsvr32 making network connections, loading scriptlet components, or spawning child processes |
certutil.exe, bitsadmin.exe | T1105 Ingress Tool Transfer; T1197 BITS Jobs; T1140 Deobfuscate/Decode Files or Information | Downloads or decodes a file onto disk with a certificate or transfer utility | 4688 or Sysmon 1; Sysmon 3 and 22; file create Sysmon 11; BITS-Client operational log | Alert when these utilities reach an external host or write an executable or script to disk, and escalate when a new process then runs from that file |
schtasks.exe | T1053.005 Scheduled Task | Creates a task, locally or on another host, for persistence or remote execution | 4698 (needs Audit Other Object Access); 4688 or Sysmon 1; Task Scheduler operational log | Alert on tasks created remotely, tasks that run from user-writable paths or launch script engines, and tasks created by unusual parents |
sc.exe, PsExec | T1569.002 Service Execution | Creates a service on a remote host to run a command, then removes it | System 7045; Security 4697; 4688 or Sysmon 1 | Alert on new services whose file is outside %windir% and Program Files (Microsoft's own monitoring advice for 4697), and on service creation from hosts outside the admin jump-host set |
LSASS memory access | T1003.001 LSASS Memory | Reads credential material from the LSASS process using a Windows DLL export or a dump utility | Process access Sysmon 10; file create Sysmon 11 | Alert on any process outside your security and management tooling opening lsass.exe with memory-read rights, and on dump files appearing on disk |
ntdsutil.exe, vssadmin.exe | T1003.003 NTDS | Copies the Active Directory database from a domain controller through a snapshot | 4688 or Sysmon 1; Sysmon 11; object access 4663; ESENT 216, 325, 326 and 327 | Alert on snapshot or install-from-media creation on a domain controller outside backup windows, and on NTDS.dit copies in unusual paths |
vssadmin.exe, wbadmin.exe, bcdedit.exe | T1490 Inhibit System Recovery | Deletes shadow copies or disables recovery, a common step just before ransomware | 4688 or Sysmon 1 | Treat as high confidence: alert and consider automatic host containment when anything other than your backup software deletes shadow copies or disables recovery |
wevtutil.exe | T1685.005 Clear Windows Event Logs | Clears event logs to remove evidence | Security 1102; System 104; 4688 or Sysmon 1 | Alert on every clear, and alert when a log source stops reporting to your central store |
Remote Desktop | T1021.001 Remote Desktop Protocol, with T1078 Valid Accounts | Moves between hosts with stolen credentials | Logon 4624 type 10; failed logon 4625 | Alert on first-seen source and destination pairs, workstation-to-workstation sessions, service accounts using RDP, and off-hours logons |
AnyDesk and other remote tools | T1219 Remote Access Tools | Installs legitimate remote-support software as a persistent back door | 4688 or Sysmon 1; Sysmon 3 and 22 | Alert on remote-access tools that are not on your approved list, first installs on a host, and servers contacting a tool's relay service |
net.exe, nltest.exe, dsquery.exe | T1087.002 Domain Account; T1482 Domain Trust Discovery | Enumerates domain users, groups, administrators and trusts | 4688 or Sysmon 1 | Score bursts: several discovery commands from one parent within minutes, especially from a non-admin account or a server that never runs them |
Event sources: the 4688, 4104 and Sysmon behavior come from Microsoft's command line process auditing, PowerShell logging and Sysmon documentation; 1102, 104 and 7045 as hunting signals from Microsoft Threat Intelligence; the NTDS events (4663 and ESENT 216, 325, 326, 327) from the CISA-led joint guidance; technique IDs from MITRE ATT&CK v20.
The coverage grid makes the priority obvious. Process creation with full command lines feeds 14 of the 16 rows, so it is the first log to fix. The other two need something else entirely: LSASS access needs Sysmon process access events and RDP needs logon events, so both stay invisible to a process-only pipeline.
Turning the matrix into working detections
Fix telemetry first. Enable Audit Process Creation and the "Include command line in process creation events" policy, which Microsoft ships disabled by default and which writes full command lines into event 4688. Turn on PowerShell script block logging (4104), and deploy Sysmon with a tuned configuration, or enable the built-in Sysmon feature on current Windows 11 builds. The joint guidance asks you to "Implement detailed logging and aggregate logs in an out-of-band, centralized location that is write-once, read-many to avoid the risk of attackers modifying or erasing logs." Command lines and script blocks can contain secrets, so restrict who can read them.
Baseline each sensitive tool. For every row in the matrix, record which hosts, accounts and parent processes normally use the tool and when. The guidance's second and third practices are to "Establish and continuously maintain baselines of network, user, administrative, and application activity" and to "Build or acquire automation (such as machine learning models) to continually review all logs to compare current activities against established behavioral baselines and alert on specified anomalies." A tool that never runs on a host is the cheapest high-fidelity alert you will ever write.
Write sequence rules, not single-event rules. One signed binary is noise. An unusual parent, followed by a script engine, followed by a first-seen destination or an LSASS read, is a story. Correlate on process GUID and logon session so the chain survives process ID reuse.
Constrain the on-ramp with application control. Microsoft describes App Control for Business as changing Windows to a place "where code runs only if your policy says so", including PowerShell in Constrained Language Mode, and publishes a list of applications that can bypass App Control and how to block them, which includes mshta.exe and wmic.exe. Microsoft is explicit that application control is "not a replacement for antivirus" (Microsoft), and it will not stop a tool your policy already trusts, so it narrows the surface the matrix has to watch.
Shrink what a stolen account can reach. With compromised credentials the top root cause in Sophos's 2026 data, least privilege, tiered administration and network segmentation limit how far a trusted tool can carry an intruder. Identity telemetry belongs next to endpoint telemetry; our analysis of device code phishing and ClickFix shows how a stolen session becomes the foothold LOTL then extends.
Plan for a 29-minute window. Average breakout is measured in minutes, so pre-approve containment actions (host isolation, session revocation, account disablement) for the high-confidence rows such as shadow copy deletion and log clearing.
How a red team or purple team validates LOTL detection
A detection you have never seen fire is a hypothesis. Validation turns the matrix into evidence, and it is human-led work: an operator has to choose techniques, adapt to what the defenders do, and stay inside agreed safety limits.
What the tester exercises. In an assumed-breach or full-chain red team, the testers start from a realistic foothold and work through the matrix the way an intruder would: discovery with built-in tools, lateral movement over RDP, WMI and remote services, persistence through scheduled tasks or WMI subscriptions, staging with transfer utilities, and controlled attempts at LSASS and NTDS access. Destructive steps such as shadow copy deletion or log clearing are emulated only on agreed test hosts, or replaced by a safe marker, under the rules of engagement. In a purple team exercise the same techniques run one at a time with your SOC and detection engineers watching, so each gap is tuned and re-run during the session. Our guide to scoping a purple team exercise lists the deliverables to write into the SOW.
What evidence you should receive. Ask for these five items in the report:
Evidence | What good looks like |
|---|---|
Per-technique outcome table | Every exercised ATT&CK v20 ID marked as not logged, logged only, alerted, or alerted and responded |
Timestamps | Tester action time against first log, first alert and first analyst action, so time to detect is measured, not estimated |
Raw event references | The event IDs and records that did or did not appear, so engineers can fix the pipeline rather than guess |
Detection gap list | For each miss, the missing telemetry or the rule logic that would have caught it, ranked by risk |
Retest result | The same techniques re-run after fixes, showing which gaps closed |
Read coverage claims carefully: a heatmap of techniques "covered" is not the same as alerts that fired under test. Our note on reading ATT&CK coverage in a red team proposal explains how to spot padding, and red team detection benchmarks show what realistic detection rates look like.
How Stingrai helps
Stingrai is a global CREST-accredited penetration testing services company founded in Toronto, Canada in 2021, with a London office. For living-off-the-land detection we lead with human testing: two named penetration testers from a team holding OSCE³, OSEP, OSED, CRTO, CRTE and CREST CRT certifications and 18 published CVEs.
Our red teaming engagements run as assumed breach, black-box full chain, or threat-intelligence-led scenarios, and exercise the matrix above against your real telemetry. Our purple teaming works against real-world TTPs with your SOC in the room, so each miss becomes a tuned detection mapped to ATT&CK v20 before the session ends. Our Active Directory security assessment covers the ACL abuse, Kerberos and delegation paths that LOTL credential access depends on. The adversary simulation case study shows a full-chain engagement in practice.
Findings post to the PTaaS portal as they are confirmed, each with a proof of concept and remediation guidance, and you can chat with the assigned penetration testers during the test. Retesting of remediated findings is included, and human-led reports come with an attestation letter. Engagements run as one-time annual tests or as continuous programs. LOTL validation is human-led; Snipe, Stingrai's autonomous AI agent, covers web applications and associated APIs, and AI and LLM applications. Stingrai's red team and purple team evidence supports your SOC 2, ISO 27001, PCI DSS and HIPAA compliance programs by showing that detection and response controls hold under realistic attack. For scoping, see the pricing page.
Frequently Asked Questions
How do you detect living-off-the-land attacks?
You baseline normal use of each sensitive tool and alert on deviations, using process lineage, command-line intent, network behavior and sequence. The tells are an unusual parent process, an unusual host, account or time, a first-seen destination, or a chain that ends in credential access or log tampering. The CISA-led joint guidance recommends maintaining behavioral baselines and building automation to compare live activity against them and alert on anomalies, because LOTL produces no conventional indicator to match.
What is living off the land and what are LOLBins?
Living off the land is reaching attacker goals with the legitimate tools already on a system instead of custom malware. LOLBins are those living-off-the-land binaries. In October 2026 the LOLBAS project listed 245 Windows entries (136 built-in binaries, 82 other Microsoft-signed binaries, 17 libraries and 10 scripts), and MITRE ATT&CK describes the core behavior as System Binary Proxy Execution (T1218), with 14 sub-techniques in v20.
Why can't you just blocklist LOLBins?
Because they are legitimate, Microsoft-signed tools your business depends on, signature and reputation checks pass them, and there is no distinctive indicator to match. The CISA-led joint guidance says defenders "should not block or limit their use indiscriminately" and should instead identify malicious use based on behavior. Removing cmd.exe, PowerShell or Remote Desktop would break administration.
Which Windows tools do attackers abuse most in living-off-the-land attacks?
The everyday administrative ones. Red Canary's 2026 report ranks PowerShell #2, the Windows Command Shell #3, Ingress Tool Transfer #5 and WMI #7 across more than 110,000 confirmed threats in 2025. Sophos's 2026 report found that only two of its 30 most-observed binaries changed year on year, and named AnyDesk as the most abused remote access tool. Volt Typhoon relied on ntdsutil, wmic, netsh, vssadmin and PowerShell, according to CISA advisory AA24-038A.
What logging do I need to catch LOTL?
At minimum: process creation with command lines (Windows event 4688 with the command-line policy enabled, or Sysmon event 1), PowerShell script block logging (event 4104), and Sysmon network (3), image load (7), process access (10), file create (11), WMI (19 to 21) and DNS (22) events. Add scheduled task (4698), service install (4697 and System 7045), logon (4624) and log-clear (1102 and System 104) events. Forward everything to a write-once central store so an intruder cannot erase it.
Does application control stop LOLBin abuse?
It helps, but not alone. Microsoft's App Control for Business runs code "only if your policy says so", extends to scripts and PowerShell in Constrained Language Mode, and Microsoft publishes a list of bypass-capable binaries to block, including mshta.exe and wmic.exe. It will not stop the abuse of a tool your policy already trusts, so it belongs alongside behavioral detection rather than instead of it.
How do we prove our SOC actually detects LOTL?
You test it. A red team or assumed-breach engagement safely emulates the living-off-the-land chain and records, per ATT&CK technique, whether each step was logged, alerted on and responded to, with timestamps. A purple team exercise runs the same techniques with your analysts present so each gap is tuned and retested in the session. Ask for a per-technique outcome table, raw event references, a ranked gap list and a retest.
Related reading
EDR Evasion in 2026: How Attacks Slip Past Detection, and How Defenders Catch Them
Purple Team Exercise: How to Scope One and What to Demand in the SOW
Will Your SOC Catch a Red Team? Detection and Response Benchmarks for 2026
Assumed Breach Engagements: When to Start the Test From Inside
HTML Smuggling in 2026: How It Slips Past Your Perimeter, and How to Detect It
Lateral Movement Explained: Attack Paths, Detection and Testing (2026)
References
CrowdStrike. 2026 Global Threat Report findings. 24 February 2026. https://www.crowdstrike.com/en-us/blog/crowdstrike-2026-global-threat-report-findings/. 82% of 2025 detections malware-free; 29-minute average eCrime breakout time; fastest 27 seconds.
Red Canary. 2026 Threat Detection Report: techniques and methodology. 2026. https://redcanary.com/threat-detection-report/techniques/ and methodology. More than 110,000 confirmed threats across 1,700 organizations in 2025; technique ranking.
Sophos. Nowhere, man: The 2026 Active Adversary Report. 2026. https://www.sophos.com/en-us/blog/2026-sophos-active-adversary-report. 661 cases, November 2024 to October 2025; Microsoft binaries up 19%; root causes; RDP use.
CISA, NSA, FBI, DOE, EPA, TSA, ASD's ACSC, Canadian Centre for Cyber Security, NCSC-UK and NCSC-NZ. Identifying and Mitigating Living Off the Land Techniques. 7 February 2024. https://www.cisa.gov/sites/default/files/2025-03/Joint-Guidance-Identifying-and-Mitigating-LOTL508.pdf. Why LOTL evades detection, logging and baselining practices, and known LOLBins mapped to ATT&CK.
CISA and partners. AA24-038A: PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure. 7 February 2024. https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-038a. Volt Typhoon's living-off-the-land tradecraft.
MITRE ATT&CK. System Binary Proxy Execution (T1218), Updates: April 2026 (v19) and Updates: October 2026 (v20). https://attack.mitre.org/techniques/T1218/, https://attack.mitre.org/resources/updates/updates-april-2026/, https://attack.mitre.org/resources/updates/updates-october-2026/.
LOLBAS Project, GTFOBins and LOOBins. Community catalogs of abusable binaries, entry counts checked October 2026. https://github.com/LOLBAS-Project/LOLBAS, https://gtfobins.org/, https://loobins.io/.
Microsoft. February 24, 2026 update (KB5077241): built-in Sysmon. https://support.microsoft.com/en-us/servicing/os/windows-11/2026/02/february-24-2026-kb5077241-os-builds-26200-7922-and-26100-7922-preview; Sysmon https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon; Command line process auditing https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/component-updates/command-line-process-auditing; about_Logging_Windows https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_logging_windows?view=powershell-7.6.
Microsoft. Application Control for Windows and Applications that can bypass App Control and how to block them. https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/appcontrol, https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/design/applications-that-can-bypass-appcontrol.
Microsoft Threat Intelligence. StilachiRAT analysis. 17 March 2025. https://www.microsoft.com/en-us/security/blog/2025/03/17/stilachirat-analysis-from-system-reconnaissance-to-cryptocurrency-theft/. Event IDs 1102, 104 and 7045 as hunting signals.
