When legitimate tools go rogue
Summary: Cisco Talos reports that attackers are increasingly using legitimate, already-installed tools rather than custom malware, citing a case where whoami, nltest and nslookup ran in sequence on a Finance Department machine at 2:13 a.m., followed by Mimikatz use on the same host and a PsExec download on a domain controller. Talos says LOLBins were used often across its 2024 incident response engagements, alongside a wider variety of commercial and open-source tools such as DonPAPI, which automates remote DPAPI credential dumping for Wi-Fi keys, RDP passwords and browser-saved credentials.
Why it matters: The tools in these intrusions are already installed, trusted and used for normal IT work, so blocking them means disrupting operations - and attackers have been observed arriving with a full toolkit of RMM software like ScreenConnect and AnyDesk, testing each until one slips through.
Read the original at Cisco Talos ↗
- Topics
- Detection & Response
- Related
- YARA-X 1.23.0 Release, (Sun, Nov 15th) Cyber Risks · Nov 15, 2026Inside Falcon AI Gateway: One Control Point for AI Traffic Cyber Risks · Nov 13, 2026Macfinger Click Fix campaign sends Down TheDRAIN infostealer for macOS, (Fri, Nov 13th) Cyber Risks · Nov 13, 2026