# Living Off the LLM: How LLMs Will Change Adversary Tactics

arXiv: https://arxiv.org/abs/2510.11398 · HTML: https://mlsanity.com/paper/2510.11398/

## Key facts

- Cited by 1 papers in the map (data through 14 Oct 2026).
- Builds on 11 of its 19 references that are in the map.
- First posted on arXiv 13 Oct 2025.

## Builds on (most cited first, 11 of 11)

- [AutoAttacker: A Large Language Model Guided System to Implement Automatic Cyber-attacks](https://mlsanity.com/paper/2403.01038/) (2024)
- [From Text to MITRE Techniques: Exploring the Malicious Use of Large Language Models for Generating Cyber Attack Payloads](https://mlsanity.com/paper/2305.15336/) (2023)
- [RatGPT: Turning online LLMs into Proxies for Malware Attacks](https://mlsanity.com/paper/2308.09183/) (2023)
- [Models Are Codes: Towards Measuring Malicious Code Poisoning Attacks on Pre-trained Model Hubs](https://mlsanity.com/paper/2409.09368/) (2024)
- [LLMs Killed the Script Kiddie: How Agents Supported by Large Language Models Change the Landscape of Network Threat Testing](https://mlsanity.com/paper/2310.06936/) (2023)
- [RapidPen: Fully Automated IP-to-Shell Penetration Testing with LLM-based Agents](https://mlsanity.com/paper/2502.16730/) (2025)
- [Living-Off-The-Land Command Detection Using Active Learning](https://mlsanity.com/paper/2111.15039/) (2021)
- [Tactics, Techniques, and Procedures (TTPs) in Interpreted Malware: A Zero-Shot Generation with Large Language Models](https://mlsanity.com/paper/2407.08532/) (2024)
- [The Art of Hide and Seek: Making Pickle-Based Model Supply Chain Poisoning Stealthy Again](https://mlsanity.com/paper/2508.19774/) (2025)
- [On the Feasibility of Fully AI-automated Vishing Attacks](https://mlsanity.com/paper/2409.13793/) (2024)
- [Demystifying the Role of Rule-based Detection in AI Systems for Windows Malware Detection](https://mlsanity.com/paper/2508.09652/) (2025)

## Built on by (most cited first, 1 of 1)

- [Stand-Alone Complex or Vibercrime? Exploring the adoption and innovation of GenAI tools, coding assistants, and agents within cybercrime ecosystems](https://mlsanity.com/paper/2603.29545/) (2026)

## Abstract (arXiv)

In living off the land attacks, malicious actors use legitimate tools and processes already present on a system to avoid detection. In this paper, we explore how the on-device LLMs of the future will become a security concern as threat actors integrate LLMs into their living off the land attack pipeline and ways the security community may mitigate this threat.