Living off the land is an attack technique that uses existing processes and locally accessible services instead of introducing conspicuous tools. By mimicking normal activity, attackers make compromised servers harder to detect. section 1.2
A quieter compromise
An attacker who controls a server may use its existing processes and local services while running cryptocurrency mining, sending phishing emails, or generating fraudulent page views. The activity can resemble legitimate server behavior rather than an obvious intrusion. section 1.2
Look for activity that does not fit the server’s normal baseline:
- Scan the network for unusual activity. section 1.2
- Search the filesystem for suspicious files. section 1.2
- Investigate unexplained spikes in resource use. section 1.2
