3 Reasons Attackers Are Using Your Trusted Tools Against You (And Why You Don’t See It Coming)

This article explores why attackers increasingly use legitimate tools already present in target environments instead of traditional malware.

• •84% of high-severity attacks now abuse legitimate tools like PowerShell, WMIC, and Certutil to evade detection, a strategy called Living off the Land (LOTL)
• •A clean Windows 11 system ships with hundreds of native binaries that can be abused, and up to 95% of access to risky tools is deemed unnecessary
• •Blocking these tools outright is impractical as it breaks workflows, and monitoring them generates too much noise to be actionable
• •EDR/XDR detection struggles to keep pace as AI-assisted attacks move faster than security teams can investigate suspicious behavior
• •Bitdefender offers a complimentary Internal Attack Surface Assessment to identify unnecessary tool access and prioritize attack paths