{"id":16223,"date":"2025-11-12T11:47:17","date_gmt":"2025-11-12T11:47:17","guid":{"rendered":"https:\/\/dmsretail.com\/RetailNews\/detecting-living-off-the-land-techniques\/"},"modified":"2025-11-12T11:47:17","modified_gmt":"2025-11-12T11:47:17","slug":"detecting-living-off-the-land-techniques","status":"publish","type":"post","link":"https:\/\/dmsretail.com\/RetailNews\/detecting-living-off-the-land-techniques\/","title":{"rendered":"Detecting Living off the Land Techniques"},"content":{"rendered":"<p> <p><a href=\"https:\/\/dmsretail.com\/online-workshops-list\/\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-496\" src=\"https:\/\/dmsretail.com\/RetailNews\/wp-content\/uploads\/2022\/05\/RETAIL-ONLINE-TRAINING-728-X-90.png\" alt=\"Retail Online Training\" width=\"729\" height=\"91\" srcset=\"https:\/\/dmsretail.com\/RetailNews\/wp-content\/uploads\/2022\/05\/RETAIL-ONLINE-TRAINING-728-X-90.png 729w, https:\/\/dmsretail.com\/RetailNews\/wp-content\/uploads\/2022\/05\/RETAIL-ONLINE-TRAINING-728-X-90-300x37.png 300w\" sizes=\"auto, (max-width: 729px) 100vw, 729px\" \/><\/a><\/p><br \/>\n<\/p>\n<div>\n<p>Long overlooked as a threat surface,\u00a0many organizations have become increasingly concerned about their network infrastructure and attackers using these devices in combination with living off the land\u00a0(LOTL)\u00a0techniques to accomplish their various nefarious objectives:\u00a0One of those actors, dubbed Salt Typhoon, made headlines earlier this year\u00a0and\u00a0brought this often neglected threat surface to the forefront in many peoples\u2019 minds.<\/p>\n<p>The Cisco Talos\u00a0analysis\u00a0of Salt Typhoon\u00a0observed that the threat actors, often using valid stolen credentials,\u00a0accessed\u00a0core networking infrastructure in several instances and then used\u00a0that infrastructure to collect a variety of information, leveraging\u00a0LOTL\u00a0techniques. Some of the recommendations to detect and\/or protect your environments include:<\/p>\n<ul class=\"wp-block-list\">\n<li>Monitor your environment for unusual changes in behavior or configuration.<\/li>\n<li>Profile (fingerprint via NetFlow and port scanning) network devices for a shift in surface view, including new ports opening\/closing and traffic to\/from (not traversing).<\/li>\n<li>Where possible, develop NetFlow visibility to\u00a0identify\u00a0unusual volumetric changes.<\/li>\n<li>Encrypt all monitoring and configuration traffic (SNMPv3, HTTPS, SSH, NETCONF, RESTCONF).<\/li>\n<li>Prevent and\u00a0monitor\u00a0for exposure of administrative or unusual interfaces (e.g., SNMP, SSH, HTTP(s)).<\/li>\n<\/ul>\n<p>Below,\u00a0we will examine how some of these monitoring and detection actions can be\u00a0accomplished\u00a0with\u00a0Cisco Secure Network Analytics\u00a0(SNA).<\/p>\n<h2 class=\"wp-block-heading has-cisco-green-color has-text-color has-link-color wp-elements-8d01a0b668d5580dc779cf77493f3b9b\" id=\"h-network-threat-detection-with-cisco-secure-network-analytics\" style=\"font-style:normal;font-weight:400\">Network Threat Detection with Cisco Secure Network Analytics<\/h2>\n<p>Through the collection of network metadata, predominately\u00a0NetFlow\/IPFIX,\u00a0Cisco\u00a0SNA\u00a0provides enterprise-wide network visibility and behavioral analytics to detect anomalies indicative of threat actor activity, such as the\u00a0LOTL\u00a0techniques used by some of these sophisticated threat actors. With a little tuning and some\u00a0customization,\u00a0the analytics and threat detections can be made to reliably\u00a0identify\u00a0threat actors misusing network equipment.<\/p>\n<p>In tuning SNA for these types of detections,\u00a0we\u2019re\u00a0going to do three major tasks:<\/p>\n<ol class=\"wp-block-list\">\n<li>Configure Host Groups for Infrastructure<\/li>\n<li>Create Custom Security Events and Role\u00a0Policies<\/li>\n<li>Create a Network Diagram for Monitoring<\/li>\n<\/ol>\n<h3 class=\"wp-block-heading has-cisco-green-color has-text-color has-link-color wp-elements-188314d27c0bde113d5bbb08f0125295\" id=\"h-1-configure-host-groups-for-infrastructure\" style=\"font-style:normal;font-weight:400\">1. Configure Host Groups for Infrastructure<\/h3>\n<ul class=\"wp-block-list\">\n<li>Define\u00a0<strong>Host Groups<\/strong>\u00a0in SNA to categorize your network infrastructure devices such as routers, switches, and jump hosts.\u00a0This grouping allows focused monitoring and easier identification of suspicious communications involving critical infrastructure.<\/li>\n<\/ul>\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-full is-resized\"><img loading=\"lazy\" decoding=\"async\" width=\"858\" height=\"858\" data-lazy-type=\"image\" src=\"https:\/\/blogs.cisco.com\/gcs\/ciscoblogs\/1\/2025\/11\/01-host_groups.webp\" alt=\"Host group management\" class=\"lazy lazy-hidden wp-image-481006\" style=\"width:598px;height:auto\"\/><noscript><img loading=\"lazy\" decoding=\"async\" width=\"858\" height=\"858\" src=\"https:\/\/blogs.cisco.com\/gcs\/ciscoblogs\/1\/2025\/11\/01-host_groups.webp\" alt=\"Host group management\" class=\"wp-image-481006\" style=\"width:598px;height:auto\"\/><\/noscript><\/figure>\n<\/div>\n<h3 class=\"wp-block-heading has-cisco-green-color has-text-color has-link-color wp-elements-bb7be020489b53f051058640d5ccca1e\" id=\"h-2-nbsp-create-custom-security-events-and-role-policies\" style=\"font-style:normal;font-weight:400\">2.\u00a0Create Custom Security Events and Role Policies<\/h3>\n<ul class=\"wp-block-list\">\n<li>Leverage threat intelligence from Cisco Talos, including indicators of compromise (IOCs) and behavioral patterns described in the\u00a0Salt Typhoon analysis.<\/li>\n<li>Build\u00a0<strong>Custom Security Events<\/strong>\u00a0in SNA to detect suspicious or forbidden communications, such as\u00a0unusual or forbidden traffic\u00a0patterns. Examples include monitoring for employees connecting to the infrastructure host groups, the use of deprecated management protocols such as telnet and suspicious communication between network management planes (ex. SSH sessions between switches).<\/li>\n<\/ul>\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-full is-resized\"><img loading=\"lazy\" decoding=\"async\" width=\"1430\" height=\"461\" data-lazy-type=\"image\" src=\"https:\/\/blogs.cisco.com\/gcs\/ciscoblogs\/1\/2025\/11\/02-Custom_Security_Events.webp\" alt=\"02-Custom_Security_Events\" class=\"lazy lazy-hidden wp-image-481014\" style=\"width:738px;height:auto\"\/><noscript><img loading=\"lazy\" decoding=\"async\" width=\"1430\" height=\"461\" src=\"https:\/\/blogs.cisco.com\/gcs\/ciscoblogs\/1\/2025\/11\/02-Custom_Security_Events.webp\" alt=\"02-Custom_Security_Events\" class=\"wp-image-481014\" style=\"width:738px;height:auto\"\/><\/noscript><\/figure>\n<\/div>\n<ul class=\"wp-block-list\">\n<li>Define\u00a0<strong>Role Policies<\/strong>\u00a0to\u00a0further tune the core events to better detect\u00a0suspicious\u00a0and\/or anomalous activity by switch management that may\u00a0indicate\u00a0lateral movement, data hoarding, and\/or exfiltration.<\/li>\n<\/ul>\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-full is-resized\"><img loading=\"lazy\" decoding=\"async\" width=\"936\" height=\"164\" data-lazy-type=\"image\" src=\"https:\/\/blogs.cisco.com\/gcs\/ciscoblogs\/1\/2025\/11\/03-Role_policies.webp\" alt=\"03-Role_policies\" class=\"lazy lazy-hidden wp-image-481016\" style=\"width:772px;height:auto\"\/><noscript><img loading=\"lazy\" decoding=\"async\" width=\"936\" height=\"164\" src=\"https:\/\/blogs.cisco.com\/gcs\/ciscoblogs\/1\/2025\/11\/03-Role_policies.webp\" alt=\"03-Role_policies\" class=\"wp-image-481016\" style=\"width:772px;height:auto\"\/><\/noscript><\/figure>\n<\/div>\n<h3 class=\"wp-block-heading has-cisco-green-color has-text-color has-link-color wp-elements-713d3e5bd2a76ccbcb2f2a6c8f967d87\" id=\"h-3-develop-a-network-diagram-for-monitoring\" style=\"font-style:normal;font-weight:400\">3. Develop a Network Diagram for Monitoring<\/h3>\n<ul class=\"wp-block-list\">\n<li>Use SNA\u2019s network\u00a0diagram feature to create a network\u00a0topology visualization to\u00a0simulate\u00a0a detailed diagram of your infrastructure hosts and their communication paths.\u00a0This visual aid helps in quickly spotting anomalous lateral movements or unexpected data flows involving jump hosts or infrastructure devices.<\/li>\n<\/ul>\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-full is-resized\"><img loading=\"lazy\" decoding=\"async\" width=\"1430\" height=\"534\" data-lazy-type=\"image\" src=\"https:\/\/blogs.cisco.com\/gcs\/ciscoblogs\/1\/2025\/11\/04-Network-diagram.webp\" alt=\"04-Network-diagram\" class=\"lazy lazy-hidden wp-image-481018\" style=\"width:726px;height:auto\"\/><noscript><img loading=\"lazy\" decoding=\"async\" width=\"1430\" height=\"534\" src=\"https:\/\/blogs.cisco.com\/gcs\/ciscoblogs\/1\/2025\/11\/04-Network-diagram.webp\" alt=\"04-Network-diagram\" class=\"wp-image-481018\" style=\"width:726px;height:auto\"\/><\/noscript><\/figure>\n<\/div>\n<h2 class=\"wp-block-heading has-cisco-green-color has-text-color has-link-color wp-elements-7cdfeeeae8c5368ecb5fe64969c1609f\" id=\"h-monitoring-for-threat-actor-activity\" style=\"font-style:normal;font-weight:400\">Monitoring for Threat Actor Activity<\/h2>\n<p>Now that\u00a0we\u2019ve\u00a0tooled some of the detection system,\u00a0we begin active monitoring. Remember that at\u00a0any time\u00a0you can always go back and tweak the custom security events or adjust the alarm thresholds in the role policy to better\u00a0monitor\u00a0your environment. Ultimately,\u00a0when\u00a0monitoring\u00a0for the\u00a0LOTL\u00a0activity expressed by these threat\u00a0actors,\u00a0we\u2019re\u00a0watching network management plane traffic and\/or other (often unmonitored) infrastructure devices for suspicious and\/or malicious seeming activity. It is always worth noting that your own security policy can have significant impact on what is determined to be suspicious and\/or malicious.<\/p>\n<p>When Alarms occur,\u00a0you can view them in the host page: in the example below,\u00a0the host\u00a0[10.1.1.1]\u00a0belonging to the host group Catalyst Switches has expressed numerous policy violations:\u00a0the custom security events above as well as Data Hoarding\u00a0(collecting a lot of data from an internal system) and Target Data Hoarding (sending large amounts of data to another system),\u00a0indicating that a malicious actor is remotely accessing this device and using its management plane to download and forward traffic.<\/p>\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-full is-resized\"><img loading=\"lazy\" decoding=\"async\" width=\"936\" height=\"298\" data-lazy-type=\"image\" src=\"https:\/\/blogs.cisco.com\/gcs\/ciscoblogs\/1\/2025\/11\/05-Host-snapshot.webp\" alt=\"05-Host-snapshot\" class=\"lazy lazy-hidden wp-image-481020\" style=\"width:744px;height:auto\"\/><noscript><img loading=\"lazy\" decoding=\"async\" width=\"936\" height=\"298\" src=\"https:\/\/blogs.cisco.com\/gcs\/ciscoblogs\/1\/2025\/11\/05-Host-snapshot.webp\" alt=\"05-Host-snapshot\" class=\"wp-image-481020\" style=\"width:744px;height:auto\"\/><\/noscript><\/figure>\n<\/div>\n<p>Digging into the flow records for the security events associated with the above switch confirms that it downloaded a large amount of data from the Bottling Line and uploaded it to an\u00a0unmonitored management desktop.<\/p>\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-full is-resized\"><img loading=\"lazy\" decoding=\"async\" width=\"936\" height=\"374\" data-lazy-type=\"image\" src=\"https:\/\/blogs.cisco.com\/gcs\/ciscoblogs\/1\/2025\/11\/06-flow-serach.webp\" alt=\"06-flow-serach\" class=\"lazy lazy-hidden wp-image-481021\" style=\"width:774px;height:auto\"\/><noscript><img loading=\"lazy\" decoding=\"async\" width=\"936\" height=\"374\" src=\"https:\/\/blogs.cisco.com\/gcs\/ciscoblogs\/1\/2025\/11\/06-flow-serach.webp\" alt=\"06-flow-serach\" class=\"wp-image-481021\" style=\"width:774px;height:auto\"\/><\/noscript><\/figure>\n<\/div>\n<h2 class=\"wp-block-heading has-cisco-green-color has-text-color has-link-color wp-elements-e60e0cdf92e6ff18c76ba3249a211605\" id=\"h-conclusion\" style=\"font-style:normal;font-weight:400\">Conclusion<\/h2>\n<p>With some clever tooling,\u00a0Cisco\u00a0SNA\u00a0can be effectively used to\u00a0monitor\u00a0infrastructure and, through the analysis of network\u00a0behavior\u00a0analysis, detect sophisticated threat actors in the environment. Types of living of the land techniques SNA can be effective at detecting on infrastructure include:<\/p>\n<ul class=\"wp-block-list\">\n<li>Unauthorized\u00a0or suspicious\u00a0logins to network devices.<\/li>\n<li>Suspicious lateral movement between infrastructure hosts.<\/li>\n<li>Data hoarding,\u00a0forwarding\u00a0and\u00a0other\u00a0unusual data flows.<\/li>\n<li>Data exfiltration\u00a0attempts\u00a0through unmonitored\u00a0hosts in the network<\/li>\n<\/ul>\n<p>Alerts generated by SNA are enriched with context such as user identity, device, location, and timestamps, enabling security teams to investigate and respond effectively.\u00a0<\/p>\n<p>To learn more about how Cisco\u00a0SNA\u00a0can help you detect advanced threats like Salt Typhoon and protect your network infrastructure, visit the\u00a0Cisco Secure Network Analytics product page\u00a0and explore\u00a0demos\u00a0and resources.<\/p>\n<hr class=\"wp-block-separator has-text-color has-light-gray-color has-alpha-channel-opacity has-light-gray-background-color has-background\"\/>\n<p class=\"has-text-align-center\"><em>We\u2019d love to hear what you think! Ask a question and stay connected with Cisco Security on social media.<\/em><\/p>\n<p class=\"has-text-align-center\"><strong><mark style=\"background-color:rgba(0, 0, 0, 0)\" class=\"has-inline-color has-cisco-green-color\">Cisco Security Social Media<\/mark><\/strong><\/p>\n<p class=\"has-text-align-center\">LinkedIn<br \/>Facebook<br \/>Instagram<br \/><a href=\"https:\/\/twitter.com\/CiscoSecure\" target=\"_blank\" rel=\"noreferrer noopener\">X<\/a><\/p>\n<\/p><\/div>\n<p><script async src=\"\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><script async defer src=\"https:\/\/platform.instagram.com\/en_US\/embeds.js\"><\/script><br \/>\n<br \/><p><a href=\"https:\/\/dmsretail.com\/online-workshops-list\/\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-496\" src=\"https:\/\/dmsretail.com\/RetailNews\/wp-content\/uploads\/2022\/05\/RETAIL-ONLINE-TRAINING-728-X-90.png\" alt=\"Retail Online Training\" width=\"729\" height=\"91\" srcset=\"https:\/\/dmsretail.com\/RetailNews\/wp-content\/uploads\/2022\/05\/RETAIL-ONLINE-TRAINING-728-X-90.png 729w, https:\/\/dmsretail.com\/RetailNews\/wp-content\/uploads\/2022\/05\/RETAIL-ONLINE-TRAINING-728-X-90-300x37.png 300w\" sizes=\"auto, (max-width: 729px) 100vw, 729px\" \/><\/a><\/p><br \/><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Long overlooked as a threat surface,\u00a0many organizations have become increasingly concerned about their network infrastructure and attackers using these devices in combination with living off [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":16224,"comment_status":"","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5],"tags":[],"class_list":["post-16223","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-technology"],"_links":{"self":[{"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/posts\/16223","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/comments?post=16223"}],"version-history":[{"count":0,"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/posts\/16223\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/media\/16224"}],"wp:attachment":[{"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/media?parent=16223"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/categories?post=16223"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/dmsretail.com\/RetailNews\/wp-json\/wp\/v2\/tags?post=16223"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}