"Living off the land" is a technique used by attackers to evade detection. It's easy to monitor for new binaries, or unsigned ones. It's harder to monitor for l

"Living off the land" is a technique used by attackers to evade detection. It's easy to monitor for new binaries, or unsigned ones. It's harder to monitor for legitimate binaries that are generally used in your environmet - it requires extra context to determine "is this suspicious". None of these programs are exploitable, they are useful to attackers. This is great for me, as someone whose job it is to protect a network - I can start thinking about how I can monitor these binaries.