Because living-off-the-land (LotL) attacks masquerade as frequently used, legitimate companies, they are very difficult to block and detect.
Source: DarkReading
Source Link: https://www.darkreading.com/vulnerabilities-threats/as-lotl-attacks-evolve-so-must-defenses