LoTL Abuse: How to Spot It vs. Normal Admin Activity

Living-off-the-land (LoTL) attacks abuse legitimate tools like PowerShell, WMI, and RMM software to blend in with normal IT activity. Five key warning signs distinguish malicious use from routine admin work: the tool appearing in unexpected hands, activity originating from unusual machines, abnormal process chains, subtly off command-line syntax, and follow-on behaviors like reconnaissance or lateral movement. Defenders should pressure-test suspicious activity by examining who used the tool, where it ran, how it launched, and what happened next. Preventive measures include better process chain visibility, stronger admin activity logging, tighter control over high-risk tools, and eliminating dormant accounts and legacy systems.

Nguồn: https://www.huntress.com/blog/lotl-abuse-warning-signs. 8sync News chỉ tóm tắt và dẫn link; bản quyền nội dung thuộc tác giả và nguồn gốc.

Đề xuất cho bạn

XDA Developers0 Hot9 phút12 giờ trước

One week with Claude Code automating my desktop taught me more about my own workflow than years of optimization

A writer who covers automation spent a week using Claude Code to clean up their chaotic Windows 11 PC. The experiment covered organizing a Downloads folder by file content (not just extension), auditing startup entries and scheduled tasks, performing disk forensics to find stale VMs and LLM model files, and batch-renaming screenshots using vision capabilities. The key insight is that AI agents handle ambiguous, judgment-heavy tasks that traditional scripts cannot — like reading a PDF to determine where it belongs. The author shares the actual prompts used throughout, emphasizes a dry-run-first, human-approval workflow to avoid accidental data loss, and notes the prompts can be reused with local LLMs.

#automation