Stealth Intrusion Vectors During LotL attacks, security software does not flag malware signatures because the actions are performed by trusted operating system components. This allows hackers to remain undetected on the network for a long time.
How to Detect the Abuse of Native Utilities Configure logging and auditing for command line execution in PowerShell and system interpreters
Restrict account privileges to prevent regular users from launching administrator scripts
Implement network behavioral analysis to catch anomalous activity from built-in services