What are Living-off-the-Land (LotL) attacks, and why does application whitelisting fail against them?

Short answer: Living-off-the-Land attacks use software that is already installed and already trusted — system utilities, administrative tools, browsers — rather than introducing new malicious files. Application whitelisting fails because the attacker is operating inside programs the whitelist explicitly permits. 
 The whitelist becomes a target list 
 Application whitelisting answers one question: "is this file allowed to run?" Modern tradecraft makes that question irrelevant. If attackers hide malicious code inside the memory of an approved process, the whitelist has already said yes. In practice, a whitelist tells an attacker precisely which processes are safest to hide inside. 
 The better question 
 Effective defense has to move from "is this file allowed?" to "what is this code actually doing right now?" That requires inspecting behavior and memory at the kernel level, where the real activity is visible — not at the file layer, which the attacker has already stepped around.