CompTIA SecurityX (CAS-005)Security OperationsMedium
A security analyst is performing threat hunting activities within the organization's SIEM. They are specifically looking for signs of a 'living off the land' attack, where attackers use legitimate system tools and processes for malicious purposes. Which of the following log analysis techniques would be most effective for detecting such an attack?
- AMonitoring for unusual process execution patterns and deviations from baselines.
- BDetecting new user account creation and privilege escalation events.
- CSearching for known malicious file hashes in endpoint logs.
- DAnalyzing network flow data for connections to known malicious IP addresses.
Show answer & explanationAnswer & explanation
Correct answer: A. Monitoring for unusual process execution patterns and deviations from baselines.
Living off the land attacks leverage legitimate tools, meaning traditional signature-based detection (like malicious file hashes or known bad IPs) is less effective. Monitoring for unusual process execution patterns and deviations from established baselines is crucial for identifying when legitimate tools are being used in an illegitimate manner.
Why the other options are wrong
- B. Detecting new user account creation and privilege escalation is important, but 'living off the land' can occur without these specific events, focusing more on process misuse.
- C. Searching for known malicious file hashes is effective for traditional malware but not for 'living off the land' attacks that use legitimate tools.
- D. While important, analyzing network flow for known malicious IPs might not catch 'living off the land' if attackers use legitimate services or IPs not yet blacklisted.
Living Off The Land (LotL)
An attack technique where adversaries use legitimate, pre-installed tools and features already present on a compromised system (e.g., PowerShell, WMI, PsExec) to carry out malicious activities, making detection difficult.
- Uses legitimate system binaries and scripts.
- Avoids introducing new malware.
- Difficult to detect with signature-based methods.
Memory trick: Hunting for threats requires looking beyond the obvious.