Which endpoint security bypass technique leverages existing system tools instead of adding executable?

Living Off the Land attacks use built-in tools such as PowerShell, WMI, certutil, and msiexec to carry out malicious operations, meaning no new binary needs to be written to disk. This approach evades signature-based endpoint detection controls that rely on identifying unknown or malicious executables.

Code signing is a technique where attackers sign malicious executables with valid certificates to appear trusted, but it still involves introducing a new executable to the system.

Compile After Delivery transfers source code or scripts to the target and compiles them locally, ultimately producing a new executable on the system.

Ghostwriting involves writing malware in obscure languages to evade detection, but it still requires delivering and executing a new binary on the endpoint.