Living off the land
Use the admin tools already on the box. PowerShell, WMI, bash, cloud CLIs. No new malware required.
Living off the land means the operator uses dual-use binaries and APIs that are supposed to be there: signed operating-system tools, package managers, identity providers, remote management. Endpoint detection that only alerts on unknown executables will nod along.
Detect unusual parents, unusual arguments, and use outside the change window. Application control and least privilege raise the cost. You will not ban every admin shell; you will watch who runs it on a domain controller at 03:00.
See also: Tactics, techniques, and procedures, MITRE ATT&CK, EDR, Persistence.