Not every cyberattack is linked to malicious software.
Windows environments already contain powerful tools capable of executing commands, changing configurations, communicating across networks, and managing operating systems. For administrators, these capabilities are essential, but they also provide attackers with a clear route to breach an environment.
PowerShell and Windows Management Instrumentation (WMI) are two prominent examples. Alongside other Living off the Land Binaries, commonly known as LOLBins, these legitimate Windows tools can be repurposed to carry out malicious activity.
This presents a challenge for defenders: How do you stop an attack when the attacker is using trusted tools already inside your environment?
The answer requires looking beyond whether an application is simply trusted or untrusted and controlling what legitimate applications are allowed to do.
What are LOLBins?
LOLBins are legitimate binaries that attackers can abuse to perform malicious actions.
Windows includes numerous built-in tools for administration, scripting, diagnostics, networking, and system management. Attackers can take advantage of their existing functionality instead of introducing dedicated malicious software.
Commonly abused Windows tools include:
- PowerShell
- WMI
- rundll32.exe
- regsvr32.exe
- mshta.exe
- certutil.exe
- bitsadmin.exe
- wscript.exe and cscript.exe
Depending on the binary, attackers may use these tools to execute commands, launch processes, retrieve files, communicate with remote infrastructure, or support other stages of an attack.
The key distinction is that LOLBins are not inherently malicious. The danger comes from how a legitimate application is being used and what it is permitted to do.
How attackers abuse PowerShell
PowerShell is a powerful Windows administration and automation framework. IT teams can use it to configure systems, automate repetitive processes, manage devices, and perform tasks across multiple endpoints.
Those same capabilities make PowerShell attractive to attackers.
After compromising an endpoint, an attack may abuse PowerShell to:
- Execute scripts and commands
- Download additional payloads
- Gather information about systems
- Modify system configurations
- Access sensitive information
- Support persistence
- Communicate with remote systems
- Assist with lateral movement
Attackers may also encode or obfuscate PowerShell commands to make their intentions harder to identify. However, the solution is rarely as simple as disabling PowerShell completely. Administrators, scripts, and business applications may legitimately depend on it.
Instead, organizations need to determine where PowerShell is necessary, who should be able to use it, and what applications should be permitted to interact with it.
How attackers abuse WMI
Windows Management Instrumentation (WMI) provides a standardized way to retrieve information from and manage Windows systems. Administrators can use WMI to query system information, manage processes, and perform actions remotely. With sufficient access and privileges, attackers may attempt to abuse these same capabilities.
One significant risk is remote execution.
After compromising an identity or endpoint, an attacker may use WMI to execute processes on other accessible Windows systems. This can potentially support lateral movement while relying on legitimate Windows management infrastructure rather than introducing an unfamiliar remote administration tool.
WMI can also be abused for persistence. An attacker may attempt to establish WMI-based mechanisms designed to trigger activity when some system events occur.
As with PowerShell, WMI itself is not malicious, but a threat actor can turn legitimate administrative functionality toward malicious objectives.
Why LOLBins make attacks harder to identify
Living off the Land attacks complicate a security model centered on identifying malicious software. Traditional malware may provide defenders with a suspicious executable, known file hash, or recognizable payload. When attackers use LOLBins, significant portions of an attack instead involve trusted software.
Seeing PowerShell running on an endpoint does not automatically indicate an attack. Neither does WMI activity. Administrators may use both every day.
The difference between legitimate and malicious activity depends on context.
Security teams need to consider questions such as:
- What launched the process?
- Which user is running it?
- What child processes did it create?
- What files or resources did it access?
- Did it make an unexpected network connection?
- Is this behavior necessary for its intended purpose?
This is why determining whether an application is "good" or "bad" is no longer enough. A legitimate application can still perform a dangerous action.
How LOLBins can expand a compromise
Consider an attacker who compromises an employee through phishing or obtains valid credentials. If that attacker can freely access powerful Windows tools, they may attempt to use them to execute commands or retrieve additional content.
If the compromised identity also has access to other systems, WMI or similar administrative tools could potentially provide another path toward remote execution and lateral movement. The more functionality available to the compromised user and endpoint, the more options an attacker has.
Organizations should therefore plan for the possibility that credentials will eventually be stolen or an individual endpoint compromised. The security objective is to prevent that initial foothold from providing unrestricted access to the rest of the environment.
Can you block PowerShell and WMI?
PowerShell, WMI, and other LOLBins exist because they perform valuable functions. Disabling them indiscriminately can interfere with legitimate administration, scripts, management platforms, and business processes.
Because blocking them outright is not an option, Zero Trust provides a more granular approach to risk mitigation.
Organizations can restrict the execution of PowerShell scripts to only those required for legitimate business or administrative tasks. Rather than allowing any script to run simply because PowerShell itself is trusted, security teams can control which scripts are permitted to execute and block those that are unauthorized or unexpected before they can act.
How to reduce the risk of PowerShell, WMI, and LOLBin abuse
Organizations can make Living off the Land attacks significantly harder by reducing the actions available after an attacker gains access.
Control application execution. Application Allowlisting can establish which software is permitted to execute, reducing an attacker's ability to introduce arbitrary executables into an environment.
Restrict application behavior. Allowing an application to run does not mean it needs unrestricted access to everything else. ThreatLocker Ringfencing™ can control how applications interact with files, other applications, network resources, the registry, and system components.
This allows organizations to restrict unnecessary relationships between applications. If a particular application has no legitimate reason to invoke PowerShell, for example, that interaction can be blocked.
Apply least privilege. Attackers seek elevated permissions because greater privileges expand what legitimate tools can accomplish. Removing standing administrator rights and providing elevation only when required can limit what a compromised user or process can do.
Control lateral movement. Access between endpoints and network resources should also follow deny-by-default principles. A compromised device should not automatically have unrestricted paths to other systems simply because it is already inside the network.
Together, these controls focus on reducing the attacker's available options rather than relying solely on detecting malicious behavior after it happens.
Stop trusted tools from becoming attack tools
PowerShell, WMI, and other LOLBins demonstrate an important limitation of security strategies focused entirely on identifying malicious files. Sometimes the tool being used in an attack is legitimate, and organizations should look beyond whether software is trusted and ask what it should be permitted to do.
Zero Trust makes that distinction enforceable. PowerShell and WMI remain valuable Windows tools. The goal is to ensure their capabilities cannot easily be turned against an environment.
Frequently asked questions
What is a LOLBin?
A LOLBin, or living-off-the-land binary, is a legitimate executable that can be repurposed by attackers for malicious activity. Rather than introducing their own tools, attackers may abuse trusted Windows binaries to execute commands, launch processes, retrieve content, or perform other actions.
How do attackers use PowerShell in cyberattacks?
Attackers can abuse PowerShell to execute scripts and commands, retrieve additional payloads, gather system information, modify configurations, communicate with remote infrastructure, and support other stages of an attack. Because PowerShell is a legitimate Windows tool, its presence alone does not necessarily indicate malicious activity.
How is WMI used in cyberattacks?
Attackers with sufficient access can abuse WMI to query systems, execute processes, perform actions remotely, support lateral movement, or establish persistence. These techniques take advantage of legitimate Windows management functionality.
Why are LOLBins difficult to detect?
LOLBins are difficult to distinguish from normal activity because they are legitimate tools that administrators and applications may use every day. Defenders therefore need to consider the context and behavior surrounding an application rather than relying only on whether the executable itself is trusted.
Should organizations disable PowerShell and WMI?
Not necessarily. PowerShell and WMI provide important administrative functionality, and disabling them entirely may disrupt legitimate operations. Organizations can instead restrict where these tools are required, who can use them, what can invoke them, and what resources they are permitted to access.
How can organizations prevent Living off the Land attacks?
Organizations can reduce the risk of Living off the Land attacks by applying deny-by-default controls, restricting application execution and behavior, removing unnecessary privileges, limiting lateral movement, and controlling how trusted applications interact with sensitive system resources. This helps contain an attacker even when they attempt to abuse legitimate tools.
