Traditional malware relies on delivery of “payload” with a custom program and data, and/or establishing persistence by installing files to local storage. These

Traditional malware relies on delivery of “payload” with a custom program and data, and/or establishing persistence by installing files to local storage. These behaviors generate distinctive evidence of compromise in-progress, active, and after the fact, so your AV software or forensics team can identify it. “Living off the Land” means minimizing or eliminating the payloads and the system modifications, and leveraging anything and everything that is found already existing in the system. Obviously while presenting extra logistical challenges, LOL can be stealthier and easier to deploy on your target systems.