{"id":76624,"date":"2023-07-17T11:24:45","date_gmt":"2023-07-17T15:24:45","guid":{"rendered":"https:\/\/www.commvault.com\/?p=76624"},"modified":"2023-07-17T11:24:46","modified_gmt":"2023-07-17T15:24:46","slug":"living-off-the-land-techniques-with-threatwise","status":"publish","type":"post","link":"https:\/\/www.commvault.com\/blogs\/living-off-the-land-techniques-with-threatwise","title":{"rendered":"Detecting Stealth and Living Off the Land Techniques Sooner, with ThreatWise"},"content":{"rendered":"\n<figure class=\"wp-block-embed is-type-video is-provider-vidyard wp-block-embed-vidyard\"><div class=\"wp-block-embed__wrapper\">\n<script type=\"text\/javascript\" async src=\"https:\/\/play.vidyard.com\/embed\/v4.js\"><\/script><img decoding=\"async\"  style=\"width: 100%; margin: auto; display: block;\"  class=\"vidyard-player-embed\"  src=\"https:\/\/play.vidyard.com\/Sfjb3UmVP3qHW55HuUU7LS.jpg\"  data-uuid=\"Sfjb3UmVP3qHW55HuUU7LS\"  data-v=\"4\"  data-type=\"inline\"  data-width=\"500\"  data-height=\"281\"\/>\n<\/div><\/figure>\n\n\n\n<p class=\"\">Cyberthreats have proved to be a perpetual game of cat and mouse. Security teams, on one hand, aim to stay one step ahead, leveling up defenses to uncover and ward off new forms of cyber threats. At the same time, bad actors are constantly evolving to employ new techniques that exploit vulnerabilities and outmaneuver even the most sophisticated of security stacks. And stealth is the name of the game&#8230; New forms of attack, including Living Off the Land techniques, are stealthy and once again upping the ante and challenging business\u2019 ability to detect threats \u2013 before data is compromised.<\/p>\n\n\n\n<h3 class=\"is-style-heading-3 wp-block-heading\">Constant Innovation Fuels Cyberthreats<\/h3>\n\n\n\n<p class=\"\">For security teams, they already have their work cut out. From the cloud to the data center, data lives in more places than ever before \u2013 and it all needs protecting. That\u2019s a lot of ground to cover, and one weak link introduces risk and potential avenues for attackers to exploit. If that wasn\u2019t challenging enough, cyberthreats also don\u2019t exactly sit still. They\u2019re constantly innovating with new tools and techniques that silently bypass security tooling and compromise systems, applications, and environments. Take for instance Locker malware, which was particularly popular in the late 2000s. Locker disrupted computer access by injecting malicious code to lock users out. Access was only regained when victims paid a ransom. Antivirus tools eventually caught up and Locker became too bulky and slow for a good success rate of attacks. Threat actors recognized this and flipped the script, favoring a new form of stealth technique that was quieter, faster, and could bypass recently improved antivirus technology &#8211; file encryption.<\/p>\n\n\n\n<h2 class=\"is-style-large is-style-heading-3 wp-block-heading\">Advanced, Silent Techniques Threaten Data<\/h2>\n\n\n\n<p class=\"\">Today, cyberthreats once again look different. Silent attacks, which can remain hidden in systems for extended periods of time, pose a unique risk to businesses. Take&nbsp;Living Off the Land techniques that leverage signed binaries (LOLBins), scripts (LOLScripts), and libraries for example. This method, recently deployed by the Volt Typhoon hacking group, is particularly novel and hard to decipher. It doesn\u2019t use conventional malware files but leverages conventional utilities, executables, and repositories to execute its attack. Traditional security tools based on signatures and traffic analysis cannot detect stealth techniques such as LOLBins used by the Volt Typhoon group, as legitimate tools\/information camouflage malicious activity to blend in and bypass even the most advanced security defenses. Once more, bad actors have moved the goal posts, leveraging new, stealthy schemas that go undetected and compromise data unbeknownst to their victims.<\/p>\n\n\n\n<h2 class=\"is-style-heading-3 wp-block-heading\" id=\"h-new-threats-require-new-thinking\">New Threats Require New Thinking<\/h2>\n\n\n\n<figure class=\"wp-block-embed is-type-video is-provider-vidyard wp-block-embed-vidyard\"><div class=\"wp-block-embed__wrapper\">\n<script type=\"text\/javascript\" async src=\"https:\/\/play.vidyard.com\/embed\/v4.js\"><\/script><img decoding=\"async\"  style=\"width: 100%; margin: auto; display: block;\"  class=\"vidyard-player-embed\"  src=\"https:\/\/play.vidyard.com\/LkKWWGTGKVtfPBmdBcGQBH.jpg\"  data-uuid=\"LkKWWGTGKVtfPBmdBcGQBH\"  data-v=\"4\"  data-type=\"inline\"  data-width=\"500\"  data-height=\"281\"\/>\n<\/div><\/figure>\n\n\n\n<p class=\"\">As advanced stealth and persistent techniques become mainstream, defending data from these attacks must also be reimagined to keep pace. Just as bad actors can cloak themselves when employing stealth techniques, defending data against these threats can also employ similar tactics. The use of modern cyber deception can alter the playing field, introducing highly effective decoys masked as real resources and assets, in turn, exposing threats lurking (or in this case, disguised and legitimate utilities) in your network. ThreatWise\u2122, Commvault\u2019s patented early warning system, offers next-generation detection capabilities to surface zero-day and unknown cyberthreats &#8211; including recent LOLBins methods. Using look-a-like authentic decoys, ThreatWise\u2122 actively defends data by obfuscating the attack surface, tricking bad actors into engaging with false resources during recon, discovery, and lateral movement. This eliminates blindspots by exposing internal and external threat actors that silently breach perimeter defenses, alerting stakeholders before its time to recover and joining IT and Security Teams for more effective incident response.<\/p>\n\n\n\n<p class=\"\">For more information on ThreatWise\u2122, please visit <a href=\"https:\/\/www.commvault.com\/platform\/products\/threatwise\">https:\/\/www.commvault.com\/platform\/products\/threatwise<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Learn how advanced stealth techniques like Living Off the Land (LOL) pose a unique risk to data security and how Commvault&#8217;s ThreatWise\u2122 offers next-generation detection capabilities.<\/p>\n","protected":false},"author":85,"featured_media":76627,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_custom_css":"","_custom_js_footer":"","_page_background_color":"","_remove_from_search":false,"_dark_mode":false,"_light_footer_mode":false,"_sidebar_form":{"id":"","name":"","cta":"","redirect":""},"_alert_notification_bar":{"show":true,"bg_color":"","content":"","call_to_action_label":"","call_to_action_link":""},"_footer_cta":{"show":false,"title":"","subtitle":"","cta_text":"","cta_link":"","background":{"id":0,"url":""}},"_cmv_customer_logo":{"id":0,"url":""},"_jetpack_memberships_contains_paid_content":false,"i18n_hreflangs":"","footnotes":""},"categories":[1185],"tags":[],"cmv_author":[1184],"class_list":{"0":"post-76624","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-cyberthreats","8":"cmv_author-steve-preston","9":"entry"},"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v23.0 (Yoast SEO v23.0) - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Living Off the Land Techniques Sooner, with ThreatWise | Blog | Commvault<\/title>\n<meta name=\"description\" content=\"Learn how advanced stealth techniques like Living Off the Land (LOL) pose a unique risk to data security and how Commvault&#039;s ThreatWise\u2122 offers next-generation detection capabilities.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.commvault.com\/blogs\/living-off-the-land-techniques-with-threatwise\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Detecting Stealth and Living Off the Land Techniques Sooner, with ThreatWise\" \/>\n<meta property=\"og:description\" content=\"Learn how advanced stealth techniques like Living Off the Land (LOL) pose a unique risk to data security and how Commvault&#039;s ThreatWise\u2122 offers next-generation detection capabilities.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.commvault.com\/blogs\/living-off-the-land-techniques-with-threatwise\" \/>\n<meta property=\"og:site_name\" content=\"Commvault - English - United States\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/Commvault\/\" \/>\n<meta property=\"article:published_time\" content=\"2023-07-17T15:24:45+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2023-07-17T15:24:46+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.commvault.com\/wp-content\/uploads\/2023\/07\/LinkedIn-1.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1200\" \/>\n\t<meta property=\"og:image:height\" content=\"628\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"dpauciullo\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@commvault\" \/>\n<meta name=\"twitter:site\" content=\"@commvault\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"dpauciullo\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Living Off the Land Techniques Sooner, with ThreatWise | Blog | Commvault","description":"Learn how advanced stealth techniques like Living Off the Land (LOL) pose a unique risk to data security and how Commvault's ThreatWise\u2122 offers next-generation detection capabilities.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.commvault.com\/blogs\/living-off-the-land-techniques-with-threatwise","og_locale":"en_US","og_type":"article","og_title":"Detecting Stealth and Living Off the Land Techniques Sooner, with ThreatWise","og_description":"Learn how advanced stealth techniques like Living Off the Land (LOL) pose a unique risk to data security and how Commvault's ThreatWise\u2122 offers next-generation detection capabilities.","og_url":"https:\/\/www.commvault.com\/blogs\/living-off-the-land-techniques-with-threatwise","og_site_name":"Commvault - English - United States","article_publisher":"https:\/\/www.facebook.com\/Commvault\/","article_published_time":"2023-07-17T15:24:45+00:00","article_modified_time":"2023-07-17T15:24:46+00:00","og_image":[{"width":1200,"height":628,"url":"https:\/\/www.commvault.com\/wp-content\/uploads\/2023\/07\/LinkedIn-1.png","type":"image\/png"}],"author":"dpauciullo","twitter_card":"summary_large_image","twitter_creator":"@commvault","twitter_site":"@commvault","twitter_misc":{"Written by":"dpauciullo","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.commvault.com\/blogs\/living-off-the-land-techniques-with-threatwise#article","isPartOf":{"@id":"https:\/\/www.commvault.com\/blogs\/living-off-the-land-techniques-with-threatwise"},"author":{"name":"dpauciullo","@id":"https:\/\/commvault-new.go-vip.net\/#\/schema\/person\/0d027e3bbfd09715cc267f372fdc4c7e"},"headline":"Detecting Stealth and Living Off the Land Techniques Sooner, with ThreatWise","datePublished":"2023-07-17T15:24:45+00:00","dateModified":"2023-07-17T15:24:46+00:00","mainEntityOfPage":{"@id":"https:\/\/www.commvault.com\/blogs\/living-off-the-land-techniques-with-threatwise"},"wordCount":618,"publisher":{"@id":"https:\/\/commvault-new.go-vip.net\/#organization"},"image":{"@id":"https:\/\/www.commvault.com\/blogs\/living-off-the-land-techniques-with-threatwise#primaryimage"},"thumbnailUrl":"https:\/\/www.commvault.com\/wp-content\/uploads\/2023\/07\/LinkedIn-1.png","articleSection":["Cyberthreats"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.commvault.com\/blogs\/living-off-the-land-techniques-with-threatwise","url":"https:\/\/www.commvault.com\/blogs\/living-off-the-land-techniques-with-threatwise","name":"Living Off the Land Techniques Sooner, with ThreatWise | Blog | Commvault","isPartOf":{"@id":"https:\/\/commvault-new.go-vip.net\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.commvault.com\/blogs\/living-off-the-land-techniques-with-threatwise#primaryimage"},"image":{"@id":"https:\/\/www.commvault.com\/blogs\/living-off-the-land-techniques-with-threatwise#primaryimage"},"thumbnailUrl":"https:\/\/www.commvault.com\/wp-content\/uploads\/2023\/07\/LinkedIn-1.png","datePublished":"2023-07-17T15:24:45+00:00","dateModified":"2023-07-17T15:24:46+00:00","description":"Learn how advanced stealth techniques like Living Off the Land (LOL) pose a unique risk to data security and how Commvault's ThreatWise\u2122 offers next-generation detection capabilities.","breadcrumb":{"@id":"https:\/\/www.commvault.com\/blogs\/living-off-the-land-techniques-with-threatwise#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.commvault.com\/blogs\/living-off-the-land-techniques-with-threatwise"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.commvault.com\/blogs\/living-off-the-land-techniques-with-threatwise#primaryimage","url":"https:\/\/www.commvault.com\/wp-content\/uploads\/2023\/07\/LinkedIn-1.png","contentUrl":"https:\/\/www.commvault.com\/wp-content\/uploads\/2023\/07\/LinkedIn-1.png","width":1200,"height":628},{"@type":"BreadcrumbList","@id":"https:\/\/www.commvault.com\/blogs\/living-off-the-land-techniques-with-threatwise#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.commvault.com\/"},{"@type":"ListItem","position":2,"name":"Detecting Stealth and Living Off the Land Techniques Sooner, with ThreatWise"}]},{"@type":"WebSite","@id":"https:\/\/commvault-new.go-vip.net\/#website","url":"https:\/\/commvault-new.go-vip.net\/","name":"Commvault - English - United States","description":"","publisher":{"@id":"https:\/\/commvault-new.go-vip.net\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/commvault-new.go-vip.net\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/commvault-new.go-vip.net\/#organization","name":"Commvault","url":"https:\/\/commvault-new.go-vip.net\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/commvault-new.go-vip.net\/#\/schema\/logo\/image\/","url":"https:\/\/www.commvault.com\/wp-content\/uploads\/2024\/03\/logo-commvault-horizontal.jpg?quality=80","contentUrl":"https:\/\/www.commvault.com\/wp-content\/uploads\/2024\/03\/logo-commvault-horizontal.jpg?quality=80","width":1200,"height":628,"caption":"Commvault"},"image":{"@id":"https:\/\/commvault-new.go-vip.net\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/Commvault\/","https:\/\/x.com\/commvault","https:\/\/www.instagram.com\/commvault\/","https:\/\/www.linkedin.com\/company\/commvault","https:\/\/www.youtube.com\/user\/commvault","https:\/\/en.wikipedia.org\/wiki\/Commvault"]},{"@type":"Person","@id":"https:\/\/commvault-new.go-vip.net\/#\/schema\/person\/0d027e3bbfd09715cc267f372fdc4c7e","name":"dpauciullo","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/commvault-new.go-vip.net\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/26a1c2b1eb2dd35e14333ef22306348e?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/26a1c2b1eb2dd35e14333ef22306348e?s=96&d=mm&r=g","caption":"dpauciullo"}}]}},"jetpack_featured_media_url":"https:\/\/www.commvault.com\/wp-content\/uploads\/2023\/07\/LinkedIn-1.png","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/www.commvault.com\/wp-json\/wp\/v2\/posts\/76624","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.commvault.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.commvault.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.commvault.com\/wp-json\/wp\/v2\/users\/85"}],"replies":[{"embeddable":true,"href":"https:\/\/www.commvault.com\/wp-json\/wp\/v2\/comments?post=76624"}],"version-history":[{"count":4,"href":"https:\/\/www.commvault.com\/wp-json\/wp\/v2\/posts\/76624\/revisions"}],"predecessor-version":[{"id":76629,"href":"https:\/\/www.commvault.com\/wp-json\/wp\/v2\/posts\/76624\/revisions\/76629"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.commvault.com\/wp-json\/wp\/v2\/media\/76627"}],"wp:attachment":[{"href":"https:\/\/www.commvault.com\/wp-json\/wp\/v2\/media?parent=76624"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.commvault.com\/wp-json\/wp\/v2\/categories?post=76624"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.commvault.com\/wp-json\/wp\/v2\/tags?post=76624"},{"taxonomy":"cmv_author","embeddable":true,"href":"https:\/\/www.commvault.com\/wp-json\/wp\/v2\/cmv_author?post=76624"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}