Living-off-the-Land (LotL) Techniques
Authorized Use Only
Execute LotL techniques only within explicitly approved scope, target systems, and test windows. Document every action with timestamps. Stop immediately if impact exceeds rules of engagement.
Objectives
- Simulate realistic threat actor behavior using only native OS tools.
- Demonstrate attack paths without introducing custom malware.
- Validate detection gaps and measure real-world exploitability.
- Produce reproducible evidence for reporting.
Approach
LotL abuses tools that already exist on the target — scripting engines, admin utilities, and built-in OS features — to blend in with legitimate activity.
Decide platform first, then select techniques:
- Windows target → see Windows Techniques below
- Linux/macOS target → see Unix Techniques below
- Mixed environment → run applicable sections for each platform
Windows Techniques
Technique families to demonstrate in approved scope:
- Execution: PowerShell, cmd, WScript, CScript, mshta, rundll32, regsvr32
- Discovery: net, nltest, ipconfig, whoami, tasklist, reg query, wmic
- Credential access: accessing memory-resident material via built-in utilities
- Lateral movement: PsExec-style invocation, WMI remote execution, WinRM
- Persistence: scheduled tasks (schtasks), registry run keys, service creation (sc)
- Exfil/staging: certutil (encode/decode), bitsadmin, curl (built-in), Invoke-WebRequest
For each technique:
- Confirm it is in scope and the target is approved.
- Use the minimal invocation needed to prove feasibility.
- Record full command line, output, and timestamp.
- Note whether any EDR/SIEM alert fired.
Unix Techniques
Technique families to demonstrate in approved scope:
- Execution: bash, sh, python3, perl, ruby, awk — whichever is present
- Discovery: id, uname, hostname, ss/netstat, ps, find, env
- Credential access: reading credential files, checking config files for embedded secrets
- Lateral movement: SSH key reuse, sudo abuse, cron-assisted pivoting
- Persistence: crontab, rc.local/systemd unit, bashrc/profile additions, SSH authorized_keys
- Exfil/staging: curl, wget, nc, python http.server, scp
For each technique:
- Confirm it is in scope and the target is approved.
- Use minimal, reversible commands that demonstrate the path.
- Record full command, output, and timestamp.
- Note whether any monitoring or alerting responded.
Execution Workflow
- Review scope and approved target list.
- Select relevant technique families based on target platform and test goals.
- Execute techniques one at a time, logging each step.
- For each successful technique, assess realistic downstream impact.
- Capture alert/detection response (or absence of it).
- Clean up any created artefacts (files, tasks, keys, registry keys).
- Package evidence for reporting.
Output Template
# LotL Techniques Output
## Engagement Context
- Targets:
- Platforms:
- Approved technique families:
- Test window:
## Demonstrated Techniques
### [Technique Name]
- Platform:
- Tool/binary used:
- Command executed:
- Output observed:
- Impact demonstrated:
- Detection triggered: Yes / No / Unknown
- Artefacts created and cleaned up:
## Detection Visibility Summary
- Techniques that triggered alerts:
- Techniques with no detection:
- Overall detection gap assessment:
## Handoff to Reporting
- High-impact paths to highlight:
- Recommended defensive improvements:
Quality Checks
- Every technique execution is timestamped and reproducible.
- All created artefacts are removed during cleanup.
- Detection response (or absence) is documented for every technique.
- Impact is framed in realistic threat-actor terms for the report.
1---2name: pt-lotl-techniques3description: Demonstrates Living-off-the-Land (LotL) techniques using native OS tools to simulate realistic threat actor behavior during authorized penetration tests. Use when proving attack feasibility without custom malware, testing detection coverage, and validating what a real adversary could achieve with only built-in system capabilities.4---56# Living-off-the-Land (LotL) Techniques78## Authorized Use Only910Execute LotL techniques only within explicitly approved scope, target systems, and test windows. Document every action with timestamps. Stop immediately if impact exceeds rules of engagement.1112## Objectives13141. Simulate realistic threat actor behavior using only native OS tools.152. Demonstrate attack paths without introducing custom malware.163. Validate detection gaps and measure real-world exploitability.174. Produce reproducible evidence for reporting.1819## Approach2021LotL abuses tools that already exist on the target — scripting engines, admin utilities, and built-in OS features — to blend in with legitimate activity.2223**Decide platform first, then select techniques:**2425- **Windows target** → see Windows Techniques below26- **Linux/macOS target** → see Unix Techniques below27- **Mixed environment** → run applicable sections for each platform2829## Windows Techniques3031Technique families to demonstrate in approved scope:3233- **Execution**: PowerShell, cmd, WScript, CScript, mshta, rundll32, regsvr3234- **Discovery**: net, nltest, ipconfig, whoami, tasklist, reg query, wmic35- **Credential access**: accessing memory-resident material via built-in utilities36- **Lateral movement**: PsExec-style invocation, WMI remote execution, WinRM37- **Persistence**: scheduled tasks (schtasks), registry run keys, service creation (sc)38- **Exfil/staging**: certutil (encode/decode), bitsadmin, curl (built-in), Invoke-WebRequest3940For each technique:411. Confirm it is in scope and the target is approved.422. Use the minimal invocation needed to prove feasibility.433. Record full command line, output, and timestamp.444. Note whether any EDR/SIEM alert fired.4546## Unix Techniques4748Technique families to demonstrate in approved scope:4950- **Execution**: bash, sh, python3, perl, ruby, awk — whichever is present51- **Discovery**: id, uname, hostname, ss/netstat, ps, find, env52- **Credential access**: reading credential files, checking config files for embedded secrets53- **Lateral movement**: SSH key reuse, sudo abuse, cron-assisted pivoting54- **Persistence**: crontab, rc.local/systemd unit, bashrc/profile additions, SSH authorized_keys55- **Exfil/staging**: curl, wget, nc, python http.server, scp5657For each technique:581. Confirm it is in scope and the target is approved.592. Use minimal, reversible commands that demonstrate the path.603. Record full command, output, and timestamp.614. Note whether any monitoring or alerting responded.6263## Execution Workflow64651. Review scope and approved target list.662. Select relevant technique families based on target platform and test goals.673. Execute techniques one at a time, logging each step.684. For each successful technique, assess realistic downstream impact.695. Capture alert/detection response (or absence of it).706. Clean up any created artefacts (files, tasks, keys, registry keys).717. Package evidence for reporting.7273## Output Template7475```markdown76# LotL Techniques Output7778## Engagement Context79- Targets:80- Platforms:81- Approved technique families:82- Test window:8384## Demonstrated Techniques85### [Technique Name]86- Platform:87- Tool/binary used:88- Command executed:89- Output observed:90- Impact demonstrated:91- Detection triggered: Yes / No / Unknown92- Artefacts created and cleaned up:9394## Detection Visibility Summary95- Techniques that triggered alerts:96- Techniques with no detection:97- Overall detection gap assessment:9899## Handoff to Reporting100- High-impact paths to highlight:101- Recommended defensive improvements:102```103104## Quality Checks105106- Every technique execution is timestamped and reproducible.107- All created artefacts are removed during cleanup.108- Detection response (or absence) is documented for every technique.109- Impact is framed in realistic threat-actor terms for the report.
santosomar