Living-off-the-land attacks are malicious operations that use legitimate tools already installed in a system, such as command shells, scripting engines, remote management utilities, or built-in administrative features. Because these tools are trusted and common, their use can blend into normal activity and avoid simple software-based detection.
These attacks matter because they reduce the need for attackers to drop custom malware. That makes them harder to spot, supports stealthy lateral movement, and can help ransomware operators disable defenses, gather credentials, or stage files while looking like routine administration. Defenders respond by monitoring for unusual command-line behavior, restricting administrative tools, using application control or allowlisting, and alerting on suspicious combinations of trusted binaries, scripts, and network activity. In practice, the danger is not the tool itself, but how it is used, when, and by whom.