A penetration tester is conducting a red team engagement and wants to move laterally using 'Living off the Land' (LotL) techniques. Which tool is most consistent with a LotL approach?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because Living off the Land techniques use tools and binaries already present on the system (WMI, PowerShell, PsExec, certutil, etc.) to perform attacker actions, making them harder to detect because they blend with normal administrative activity. A is wrong because a custom compiled C2 agent is a bespoke tool, not a built-in system utility.
Full explanation below image
Full Explanation
B is correct because Living off the Land techniques use tools and binaries already present on the system (WMI, PowerShell, PsExec, certutil, etc.) to perform attacker actions, making them harder to detect because they blend with normal administrative activity. A is wrong because a custom compiled C2 agent is a bespoke tool, not a built-in system utility. C is wrong because Metasploit meterpreter is an attacker-deployed tool, not a system-native binary. D is wrong because zero-day exploitation is a specific initial access technique, not a lateral movement technique based on system-native tools.