THREAT OPS › Threat News › LoTL Abuse: How to Spot It vs. Normal Admin Activity | Huntress
LoTL Abuse: How to Spot It vs. Normal Admin Activity | Huntress
LoTL abuse hides in plain sign, using legit tools like PowerShell and RMM software. Learn how to spot the warning signs that separate from routine IT work.
MITRE ATT&CK techniques
- PowerShellT1059.001
Original source: https://www.huntress.com/blog/lotl-abuse-warning-signs