1. What does 'living off the land' mean in an offensive security context?
Installing a custom rootkit that disguises itself as a Windows service Using only the tools and binaries that already ship with the operating system, instead of uploading attacker-controlled software, to carry out reconnaissance and execution Exploiting a known vulnerability in a Windows kernel driver Downloading and running a memory-only implant that never touches disk 2. Why are LOLBins like rundll32.exe and installutil.exe effective for bypassing application allowlisting?
They exploit a vulnerability in the AppLocker signature-verification engine They are Microsoft-signed and live under C:\Windows, so AppLocker's default rules permit them, and the malicious payload runs under the identity of a trusted Windows binary They run in kernel mode, which AppLocker does not monitor They disable AppLocker as part of their normal execution 3. An attacker uses PowerShell, WMI, and dsquery to enumerate users, groups, and domain controllers. No alert fires. What best explains this?
The SIEM was offline during the attack Native administrative tools generate the same log entries for attacker recon as they do for routine administration, making the malicious activity hard to distinguish from normal IT work PowerShell, WMI, and dsquery are not logged by Windows AD enumeration requires Domain Admin rights, so the attacker was blocked 4. What two distinct gains does living off the land provide an attacker?
Persistence and credential theft Quiet enumeration of the host, network, and domain using native commands, and the ability to execute a payload past allowlisting and signature-based defenses using trusted binaries Remote code execution without a foothold and privilege escalation to Domain Admin Faster attack speed and lower memory usage 5. Why might an attacker invoke PowerShell version 2 (--version 2) on a target host?
Version 2 supports newer AD cmdlets that are not available in later versions PowerShell version 2 predates script-block logging and module logging, so invoking it sidesteps those logging mechanisms even on a system where modern PowerShell is the default Version 2 can bypass Windows Defender Application Control Version 2 runs entirely in kernel mode, avoiding user-space monitoring 6. How would you explain the risk of living off the land to a non-technical stakeholder?
Tell the stakeholder that the attacker installed malware on the server Explain that an attacker who is already inside uses the tools that came with Windows, the same ones your administrators use, so activity that should look suspicious instead looks like ordinary system administration Say that the attacker exploited a vulnerability in Windows that Microsoft has not patched yet Explain that the server needs to be taken offline and rebuilt 7. A candidate says: 'Living off the land just means running commands that are already on the box; no skill involved since the tools are built in.' What is wrong with this answer?
Nothing: the tools are built in, so anyone can use them The answer misses that knowing which legitimate binary can be coerced into code execution, and how to do it without tripping behavioral detection, is the actual expertise, and it conflates enumeration benefit with execution benefit The answer is almost correct but should add that domain admin rights are required The answer is wrong only because it does not mention BloodHound 
