Living off the land means an attacker does not bring a noisy custom program, but uses tools already present on the system. That can include a shellA program that accepts user commands and runs them on the system. More, PowerShellA command environment and scripting language used mainly on Windows. More, curlA command-line tool for downloading or sending data over the network. More or system utilities. Detection is harder because the tool itself is legitimate.
