or Apps going rogue, Sleeper apps :) you get the point
SecureWorks coined the term 'Living Off the Land'. The term refers to threat actors "using credentials, systems, and tools they collect along the way instead of backdoors".
This is an collection of examples of legitimate tools/commands reported to have been used by Hackers. The list includes only examples where I could locate an actual reference and where there is high prevalence i.e. it is typically found by "default" on many endpoints. Also considered for inclusion tools signed by publishers that are likely configured to be approved by application whitelisting implementation (like PSExec and Delete signed by Microsoft).
Review and make decisions if there is something you should be somehow managing, for example:
- Control it through application whitelisting, manage who can execute it.
- Remove it from the system.
- Monitor for their execution.
If you find anything to add/change let me know.