Attack

Living off the land

Attacking with tools already on the system, such as PowerShell, so nothing looks like malware.

Instead of dropping their own programs, attackers use built-in administration tools. The activity blends in with normal IT work, so detecting it depends on behaviour (what a tool does, when and from where), not on spotting a malicious file.