Most threat libraries are written for laptops. This one is written for servers, not laptops, because the techniques differ and the assumptions that hold on an endpoint do not hold on a domain controller or a database host.
Living off the land is an attack technique that uses the legitimate tools already installed on a system rather than introducing new malware. PowerShell, WMI, certutil, regsvr32 and dozens of other signed, trusted binaries can be used to move laterally, establish persistence and stage data. Because the binaries are legitimate and signed, signature-based detection has nothing to match on, and behavioral detection has to distinguish malicious use of an admin tool from ordinary use of the same tool by an administrator.
An enterprise server runs a narrower and more predictable set of software than a laptop, which is an advantage defenders rarely use. The set of binaries that should ever execute on a production database host is small and stable. The set that actually can execute is enormous. That gap is the attack surface this library catalogs.
Detection asks whether an action looks malicious. On a signed system binary used by an administrator every day, that question is genuinely hard. Known-good enforcement asks whether the change the tool is attempting was authorized. A trusted binary can be used for authorized tasks and still be blocked from making an unauthorized change, because the decision evaluates the change rather than the tool or the credential behind it.
Related reading: The Patch Window, The Exploit Path, and the Known-Good Enforcement Glossary.
The live view below catalogs observed server-side techniques and the trusted binaries associated with them. Sources include LOLBAS, GTFOBins and MITRE ATT&CK.
