Living off the land
Living off the land is the abuse of native or already available trusted tools and processes to carry out attacker activity within an environment.
The tool can be legitimate while the task is not
Administrators use system utilities and management tools to keep an environment working. Attackers can use some of the same capabilities. Joint agency guidance describes native-tool abuse across operating systems and cloud environments, and also discusses third-party administration tools already available to attackers.
Microsoft’s Astaroth investigation provides a documented example of legitimate system tools being used in a malicious execution chain. This is a behavior pattern, not a claim that those tools are always malicious or that the attack leaves no files or records.
Review the use, not only the executable
Ask which identity launched the tool, what started it, what task it performed, and which systems or destinations it touched. Compare that context with authorized administrative work. A trusted signature or familiar program name cannot approve every possible use.
The ClickFix article covers a related path from deceptive instructions to execution. Fake IT support covers abuse of a legitimate support session. In either case, the investigation needs to distinguish the installed tool from the person directing its use.
The joint guidance recommends meaningful logging, baselines, and restricted use of powerful tools. SOC scenario visibility helps check whether the relevant activity was collected and surfaced to defenders.