Living Off the Land in ICS/OT Cybersecurity

This Dragos report explains how adversaries leverage legitimate, pre-existing IT and OT capabilities to "live off the land"—stealing credentials, pivoting from IT into OT, and abusing native ICS/OT functionality to perform reconnaissance and potentially disruptive operations—and provides practical detection and mitigation guidance (account monitoring, PowerShell/WMI logging, SMB visibility, honey credentials, and ICS protocol baselining) tailored to operational environments.