What does living off the land mean?
Living off the land means attackers use the tools already on your systems, such as PowerShell, remote desktop or administration utilities, instead of their own malware. Antivirus often lets them through because the tools are legitimate. What gives them away is unusual use, such as an account signing in where it never has or a workstation opening sessions to many servers. Keeping baselines of normal activity helps, and so does limiting who may use administration tools at all. NetSenX flags new host-to-host sessions, scanning and lateral movement from the network, on every plan. What happens entirely inside one host, such as a script reading files, never crosses the network and needs endpoint detection.