Living off the Land in an ICS/OT Penetration Test
Aaron Boyd demonstrates Living off the Land (LotL) techniques in OT environments, utilizing native engineering tools and HMI scripts to pivot undetected.
Summary
Evading Signature Detections with Living off the Land
Modern OT security appliances and application whitelisting solutions monitor for unknown binaries, forcing adversaries to rely on native tools already present on host systems.
Repurposing Native Engineering and HMI Utilities
Aaron Boyd demonstrates how attackers leverage built-in Windows administrative utilities, SCADA scripting engines, and vendor maintenance binaries for lateral movement.
Pivoting Across Industrial Control Segments
Using native PowerShell, WMI, and engineering workstation software, an operator can extract controller project files and send unauthorized PLC commands without dropping custom malware.
Defending Industrial Environments Against LotL Attacks
Boyd outlines behavioral monitoring strategies and strict execution policy configurations to detect malicious use of legitimate engineering utilities.
Related talks
Red Team Village·1 hr
Anthony Rose · Jake Krasnov
Anthony Rose and Jake Krasnov debunk the myth that PowerShell is dead for red teams, showing how modern adversaries weaponize PowerShell while evading AMSI and logging.
Main Stage·21 min
Rich Kelley
Rich Kelley introduces Harness, a remote PowerShell payload execution and management framework designed for stealthy interactive post-exploitation.
Black Hat·40 min
Presenters detail vulnerability discovery and exploitation in Fantastic Red-Team Attacks and How to Find Them.