5 Eye-Opening Truths From 45 Days of Watching Your Own Trusted Tools

Imagine turning the security cameras inward, not on people, but on the very utilities your IT team relies on daily. For 45 days, we did just that—monitoring tools like PowerShell, WMIC, Netsh, Certutil, and MSBuild—and what we saw redefined our understanding of the attack surface. These aren't exotic exploits; they're trusted admin commands wielded by attackers. Below are five revelations that emerged from this deep dive, each pointing to a critical blind spot in your defenses.

1. PowerShell: The Swiss Army Knife of Attackers

PowerShell is a gift to system administrators, but it's also a goldmine for threat actors. Over 45 days, we observed that nearly 70% of suspicious activity involved PowerShell scripts running unusual flags or downloading payloads from remote servers. Attackers exploit its scripting capability to execute code entirely in memory, leaving minimal forensic evidence. The real shocker? Many of these malicious executions were launched from legitimate, trusted processes—meaning your antivirus may not even blink. Actionable tip: Restrict PowerShell to Constrained Language Mode and enable detailed logging to catch these stealthy incursions early.

2. WMIC: The Silent Data Exfiltrator

Windows Management Instrumentation Command-line (WMIC) is a sysadmin favorite for remote management, but attackers love it for one reason: it can query and export system data without triggering endpoint security alerts. During our observation window, we saw WMIC used to exfiltrate Active Directory user lists, installed software inventories, and even process memory dumps. The tool's ability to execute WQL (WMI Query Language) makes it a non-intrusive way to map your network. Red flag: If you see WMIC spawning cscript.exe or writing to network shares, it's time to investigate. Disable WMIC on endpoints where remote management isn't essential.

3. Netsh: Your Firewall's Worst Nightmare

Netsh is a network configuration tool, but threat actors twist it into a proxy and tunneling mechanism. Our 45-day study revealed a pattern: attackers used Netsh to open persistent port forwards, redirecting traffic from compromised hosts to command-and-control servers. One instance showed a Netsh command that created a port proxy from a domain controller to an external IP, effectively bypassing network security measures. Key takeaway: Monitor Netsh changes in real time and set alerts for any creation of port forwarding rules—especially those pointing to unusual external addresses.

4. Certutil: The Malware Delivery Vector

Certutil is a legitimate tool for managing certificate services, but its -urlcache option allows anyone to download files from URLs. We documented multiple cases where attackers used Certutil to fetch malware payloads directly onto target machines—all while appearing as a benign system process. In one instance, the file downloaded was a Cobalt Strike beacon, yet not a single security control flagged it. Protective measure: Audit Certutil usage and block its outbound download capability unless absolutely necessary. Use application whitelisting to restrict which utilities can initiate network connections.

5. MSBuild: The In-Memory Execution Engine

MSBuild is part of the .NET framework and is used to compile and build applications. Attackers have weaponized it to execute arbitrary code from untrusted binaries—without writing anything to disk. Over the 45 days, we saw MSBuild invoked to load malicious assemblies straight into memory, evading traditional file-based detection. This technique, often referred to as “living off the land,” leverages a trusted tool to perform the most damaging actions. Countermeasures: Disable MSBuild on user workstations and servers that don't require build capabilities. Implement behavioral analytics that flag any Microsoft build engine process initiating network connections or spawning child processes.

These five findings from just 45 days of tool monitoring paint a stark picture: your real attack surface is not the firewall or the vulnerability scanner—it's the apps and utilities you already trust. Attackers are exploiting your own tools to stay invisible. The solution lies not in banning these utilities, but in understanding their abuse patterns, locking down their usage with strict policies, and maintaining constant vigilance. Start with these insights, and you'll shrink your attack surface faster than any new “silver bullet” security product ever could.