living off the land
jargonsecurityhacking
Attacking with the tools already installed on the victim's systems, so nothing malicious ever has to be downloaded.
PowerShell, WMI, certutil, PsExec: all legitimate, all signed, all abusable. It defeats naive antivirus because there is no malware file to find; defenders answer with behavioral detection and with logging what the built-in tools are doing.
Also known as: LOTL, LOLBins