On a compromised server, an attacker uses only the operating system's built-in scripting shell, scheduled task utility and remote management tools. No custom malware is dropped, and antivirus raises no alerts. Which technique is the attacker relying on?
Select an answer to reveal the explanation.
Short Explanation
Why bring your own tools when the house already has a full toolbox? Living off the land means the attacker uses the same shell and admin utilities your own team uses, so there's nothing new for antivirus to catch. The trap is thinking "no malware found" means "no attacker."
Full Explanation
Living-off-the-land techniques abuse tools that already exist on the endpoint, such as command shells, scripting engines, scheduling utilities and remote management features. Because these binaries are legitimate, signed and used daily by administrators, their presence raises no file-based alerts, and malicious use blends with normal activity. That matches an attacker who drops no custom malware yet runs scripts, schedules tasks and moves between systems. A malicious update delivered through a vendor channel describes how initial code might reach many customers, but the scenario involves an attacker already on the server using native tools, and nothing was installed from a vendor. A rootkit modifies the operating system, often at kernel level, to conceal files and processes; replacing drivers is a significant change that the scenario explicitly does not describe. A watering hole compromises a website that targets visit in order to infect them, which is a delivery method, not a post-compromise technique on a server. Exam caveat: endpoint-based vectors in the objectives explicitly include built-in tools and living-off-the-land tools. Operational check: enable command-line and script logging, alert on unusual parent-child process chains and administrative tool use from unexpected accounts, and restrict who can run remote management utilities.