Redesigning the Network to Fend Off Living-Off-the-Land Tactics

This report outlines defender strategies to detect and counter living-off-the-land (LotL) tactics by tightening identity and privilege controls (zero trust/least privilege), improving visibility with CASB/SASE, and prioritizing high-value telemetry guided by resources like LOLBAS and MITRE ATT&CK. It highlights practical detections—especially for unauthorized RMM tool use—hardening steps such as changing default handlers for scripting files, and stronger governance for service accounts. The overarching theme is optimizing logging and analytics to surface behavioral anomalies and accelerating SecOps response to contain intrusions early.