Living off the land reduces new-tool visibility
When nothing new arrives on the machine, the detections that watch for new things see nothing.
That is the entire appeal. Blocking unknown executables does not help when the executable is the one the operating system ships. The signal moves to context: this account does not normally run this, at this hour, against these systems.
More on Ransomware and malware
- Ransomware is often the last stage, not the firstThe bang is the end of the fuse
- Backups are ransomware targetsThe lifeboat goes first
- Lateral movement turns one foothold into manyAlong the loft, house to house
- Command and control gives malware an operatorSomebody is still holding the controller
- Persistence is about surviving changeStill there after the tide
- Ransomware recovery is an identity problem tooThe data is the easy half