The technique in which an intruder avoids using custom malware as far as possible and works with legitimate tools already present in the OS, such as PowerShell, WMI and the standard remote administration features, is called "living off the land". Which of the following is the most appropriate way of thinking about countermeasures to this technique?

Answer: C. Record who ran the legitimate tools, with which arguments and from which parent process, detect unusual use, and limit the people and devices that can use administration tools

In a living-off-the-land attack the programs themselves are legitimate and signed, so methods that recognize known malware by file characteristics cannot detect it. Instead, command arguments and parent-child relationships are collected with EDR and OS logs (such as PowerShell script logging and process creation records), and detection relies on use that differs from normal work, such as "PowerShell launched by an application that opened a document" or "a long encoded command was run". In addition, limiting the users and devices that can use administration tools and allowing only approved applications to run reduce the tools available to the attacker.

• A. Legitimate tools have valid signatures, so checking signatures cannot tell malicious use apart.
• B. Defenses at the point of entry alone cannot stop attacks that get through. Detection and response after an intrusion are also needed.
• C. Correct. Record who ran what and how, detect by behavior and also narrow the scope of use.