eSecurity Planet: Living Off the Land Attacks: LOTL Definition & Prevention
NetSPI Principal Consultant Derek Wilson is featured in eSecurity Planet, sharing insights on Living Off the Land (LOTL) attacks and how to prevent them. Read the preview below or find the full article at https://www.esecurityplanet.com/networks/living-off-the-land-attacks/.
+++
5 Best Practices for Preventing LOTL Attacks
The following strategies help your business not only prepare for LOTL attacks but also reduce threat actors’ opportunities to compromise your legitimate systems.
Use LOLBINS To Track Binary Activity
The Living off the Land Binaries, Scripts, and Libraries project (LOLBAS) offers a comprehensive list of exploits attackers use. It’s best to study one binary (LOLBIN) at a time, examining how the specific program is typically used. Once your team knows what appropriate usage looks like, you can begin identifying abnormal behavior from that program.
Derek Wilson, principal consultant at security firm NetSPI, underscored the importance of using this resource. “By finding a way to baseline detections against something like the Living Off the Land Binaries And Scripts (LOLBAS) project, which is set up to track LOTL threats, teams can then build proactive detection plans for the procedures that aren’t caught,” he said.
Wilson recommended additional software to help teams develop general detection methods. “Breach and attack simulation (BAS) tools are invaluable in baselining detective controls and continuously improving detection of LOTL attacks,” he said. BAS tools give security teams insight into an attack lifecycle, behaving like a threat actor might to find security weaknesses more quickly.
You can read the full article here!
Explore More News
SC Media: Compromised at the Core: Why Identity Remains Cyber’s Biggest Flaw
Nick Walker, Regional Director, EMEA at NetSPI, in an article published in SC Magazine, warns that identity compromise, not exotic malware, remains the most dangerous weakness in enterprise cybersecurity.
Tech Monitor: Why foundational defences against ransomware matter more than the AI threat
Ben Lister, head of threat research at NetSPI, in an article published on Tech Monitor, makes the case that companies should focus on getting the basics of cybersecurity right, rather than worrying about hypothetical AI-driven ransomware threats.
Pioneer Press: What to know from cyberattacks in other U.S. cities
NetSPI CEO Aaron Shilts was featured in the Pioneer Press discussing why state and local governments are prime targets for ransomware attacks.