The intrusions that keep defenders awake are not the loud ones. A ransomware note on every screen is a failure that announces itself; you know the day it happened. The dangerous adversary is the one who has been inside for months and looks, on every dashboard you own, exactly like your own administrators going about their work. That is not a new problem. It is the oldest idea in the deception playbook, and the Soviets gave it a name.
Military foundation
Maskirovka is the Russian and Soviet doctrine of military deception — but the word is broader than the English term. It is not a single ruse; it is a system that runs from camouflaging a tank up to deceiving an entire theatre command about where and when an offensive will fall. Its aim is to deny the adversary an accurate picture of reality until acting on the truth is no longer possible. It works on two faces at once: concealment, hiding what is real, and simulation, showing what is false. Done well, the two merge, and the genuine becomes indistinguishable from the routine.
The decisive move in maskirovka is rarely a clever fake. It is making the real thing look like nothing worth a second glance. A unit that moves at the same tempo as ordinary traffic, on the same roads, in the same patterns, is hidden not because it cannot be seen but because seeing it tells the observer nothing. The deception is in the interpretation, not the photograph. An analyst who has everything in front of them and still draws the wrong conclusion has been defeated more completely than one who was simply kept in the dark.
Cyber application
Living-off-the-land is maskirovka rendered in code. Instead of dropping custom malware that a scanner can fingerprint, the intruder operates with the tools already present and trusted on the host: PowerShell, WMI, certutil, netsh, scheduled tasks, signed system binaries. Nothing foreign is introduced, so there is no malicious file to flag and little that stands out as an artifact. The operator’s activity is camouflaged by being, technically, the same activity your own staff perform every day.
The clearest public example is Volt Typhoon, the state-sponsored actor that US agencies have described conducting long-dwell intrusions into critical-infrastructure networks using almost entirely living-off-the-land tradecraft. The point of that approach is not stealth for its own sake; it is to deny defenders an accurate picture. There is no signature to write, because the “weapon” is your own toolset. The deception, exactly as in maskirovka, lives in the interpretation: a SOC analyst can have every relevant log in front of them and still read the session as ordinary administration.
This is why signature-based detection loses against a competent living-off-the-land operator, and why the answer is behaviour and context rather than indicators. You cannot ask “is this binary malicious” when the binary is signed by the operating-system vendor. You have to ask whether this use of it fits the baseline: PowerShell spawned by a process that has no business launching it, certutil reaching out to the internet, a service account suddenly behaving interactively, a scheduled task created at an hour no human keeps. The relevant techniques map cleanly onto MITRE ATT&CK — signed binary proxy execution (T1218), command and scripting interpreters (T1059), and account manipulation among them — and the contest reduces to a single question: can the defender tell the staged from the genuine before it matters?
What you practise
In the range this stops being a reading exercise and becomes a match. On the offensive side you run the living-off-the-land playbook against a defended host: accomplish the objective using only what is already there, minimise the artifacts you leave, and keep your activity inside the shape of normal traffic. On the defensive side you do the harder work — build the baseline first, because you cannot detect a deviation from a normal you never characterised, then hunt the anomaly while a live opponent is actively trying to look ordinary. The AI Coach maps each move to ATT&CK as it happens and shows you, afterwards, the exact moment the genuine and the staged diverged.
It is the whole doctrine in one scenario. The three layers are all present: a real adversary’s tradecraft drawn from the world (Cyber Crime), the hands-on craft of blending in and of catching what blends in (Ethical Hacking), and above both the strategic contest of deception against counter-deception (WAR). The habit you are building is the analyst’s discipline maskirovka was designed to defeat — refusing to accept that looks routine means is routine, and learning to read the picture instead of the file. Against an opponent whose entire method is to be unremarkable, the defender who has practised seeing through it wins the only contest that counts.