ATT&CK Dual-Use Admin and Recon Tools Software Hub: Separating Legitimate Admin Use From Attacker Use

The tools most often seen in intrusions are ones your administrators also use every day, so blocking by name fails and detection has to rest on who ran a tool, from where and against what. This hub catalogues the 59 entries in MITRE ATT&CK Enterprise v20 that NHI Mgmt Group groups as dual-use administration and reconnaissance tools: built-in Windows utilities such as Net, Nltest and certutil, Sysinternals PsExec and SDelete, directory and cloud identity enumeration tools such as AdFind, BloodHound, AADInternals and ROADTools, remote support software, tunnelling and sync tools such as ngrok, FRP and Rclone, and a handful of group-specific tools. ATT&CK types every one of them as a tool, not malware. The page computes the behaviours they share from ATT&CK's technique mappings and turns them into detection, hardening and measurement guidance. It is written for SOC analysts, detection engineers and Windows, identity and network administrators. For living off the land as a discipline, see the Living off the Land Guide; this hub is the catalogue and does not repeat it.

Key takeaways

• A few tools carry most of the use: ATT&CK v20 links PsExec to 39 groups and Net to 33, followed by Ping (15), ipconfig and certutil (14 each), Tasklist (13) and AdFind (12). Behaviour-based detections for these pay back fastest.
• Discovery dominates the catalogue: 10 tools map to T1016 System Network Configuration Discovery and 8 to T1018 Remote System Discovery, and domain account, group and trust discovery (T1087.002, T1069.002, T1482) each appear on four tools. The shape of the commands, not the binary, is the signal.
• Tool transfer is the most shared technique: 12 tools map to T1105 Ingress Tool Transfer, including certutil, BITSAdmin, ftp, esentutl and cmd, so outbound downloads by built-in binaries deserve their own rules.
• State actors favour the built-ins: Volt Typhoon is associated with 14 of the 59 tools, APT29 with 12 and Turla with 11, which matches government warnings that living off the land avoids custom malware.
• Identity is where the damage happens: AADInternals, ROADTools, BloodHound and AdFind map directory and tenant relationships, and the remote execution tools only work with valid admin credentials. Protecting admin and service accounts removes more of this catalogue than any blocklist.

What this category covers and why it matters

ATT&CK separates software into malware and tools. Tools are commercial, open-source, built-in or publicly available software that both defenders and adversaries can use. This hub collects the tools whose normal job is administration, troubleshooting, support or reconnaissance. Credential theft and Active Directory attack tools such as Mimikatz and Impacket are in the ATT&CK Credential and Active Directory Attack Tools Software Hub, and command and control frameworks in the ATT&CK C2 and Post-Exploitation Frameworks Software Hub.

The category matters for three reasons. First, the February 2024 joint guidance on living off the land from CISA, NSA, FBI and partner agencies in Australia, Canada, the UK and New Zealand notes that native tools blend into normal activity, that many organisations lack baselines and that default logging is often insufficient. Second, several entries are signed, trusted software: PsExec is a Microsoft Sysinternals tool that runs processes on remote systems without manual client installation, and Quick Assist ships with Windows 11. Third, a few entries carry the "tool" label in ATT&CK but behave like remote access trojans (Remcos, Imminent Monitor, DCRAT, PcShare); they are listed here because that is how ATT&CK classifies them, and they deserve the same response as malware when found without a business owner.

Common behaviours across the catalogue

The counts below come from ATT&CK v20 technique relationships across the 59 members (a tool counts once per technique).

For each technique, the deep defensive pages are the T1105 Ingress Tool Transfer Defensive Guide, T1016 System Network Configuration Discovery, T1018 Remote System Discovery, MITRE ATT&CK T1570 Lateral Tool Transfer, MITRE ATT&CK T1569 System Services, T1087 and T1069 Account and Permission Group Discovery Defensive Guide and MITRE ATT&CK T1482 Domain Trust Discovery.

Catalogue: every dual-use admin and recon tool in ATT&CK v20

All 59 entries, grouped by sub-group and sorted by ATT&CK ID. Groups are those ATT&CK v20 records as using the tool, alphabetically, with a count where there are more than five. Key techniques are a selection from ATT&CK's mappings for that tool. Where ATT&CK records no platform, the operating system the utility ships with or runs on is shown and marked (NHI Mgmt Group note).

Built-in discovery utilities

Built-in execution, scheduling, transfer and log utilities

Remote execution tools

Disk, deletion and wiping utilities

Directory, identity and mail reconnaissance

Remote access and support software

Tunnelling, proxy and exfiltration tools

Group-specific tools and frameworks

Real cases

• Help desk impersonation to ransomware: Microsoft reported in May 2024 that Storm-1811 used vishing, email bombing and later Teams messages from attacker tenants named "Help Desk" to talk users into Quick Assist sessions, then used cURL and BITSAdmin to fetch payloads, added ScreenConnect and NetSupport Manager, and used PsExec to deploy Black Basta. See the Storm-1811 Threat Actor Profile and the Email Bombing and Help Desk Impersonation over Teams Guide.
• Portable remote support tools: CISA, NSA and MS-ISAC warned in January 2023 that help desk phishing led federal staff to run portable ScreenConnect and AnyDesk executables, which need no installation or administrator rights and so bypass install controls. See MITRE ATT&CK T1219 Remote Access Tools.
• Hybrid identity takeover: the Storm-0501 hybrid cloud attack combined Entra Connect Sync account credentials with AADInternals to add a rogue federated domain, and used Rclone to move data to cloud storage before ransomware.
• State actors living off the land: ATT&CK associates Volt Typhoon with 14 tools in this catalogue, including Net, Nltest, netsh, Wevtutil, certutil, PsExec and FRP. See the Volt Typhoon Threat Actor Profile.

Detection themes

Dual-use detection rarely works on a single event. It works when the event is compared with who normally runs the tool, from which host and at what volume.

Collection details are in the Windows Event Log Guide and the Sysmon Guide. For tunnelling tools, see Detecting Ligolo-ng, Chisel and frp Tunnelling Tools; for directory attack paths, the BloodHound and Active Directory Attack Path Guide.

Hardening that breaks the common chains

1. Inventory who legitimately uses each tool: list the admin groups, hosts and scripts that run PsExec, remote support software, AdFind and similar. This baseline is the precondition for every rule below.
2. Turn on the telemetry: process creation with command line, PowerShell script block logging, and service installation events, forwarded off-host to write-once storage as the joint LOTL guidance recommends.
3. Apply attack surface reduction in audit first: on Microsoft Defender, enable "Block process creations originating from PSExec and WMI commands" (GUID d1e49aac-8f56-4280-b9ba-993a6d77406c) and "Block use of copied or impersonated system tools" in audit mode, review hits for two to four weeks, then block. Microsoft warns that the PSExec and WMI rule conflicts with Configuration Manager, which relies on WMI. Roll back by returning the rule to audit.
4. Allow only approved remote support tools: use application control to block unapproved and portable remote access software, and block the relay domains of products you do not use. Remove Quick Assist where an authenticated alternative is in use, as Microsoft recommends. See the Application Allowlisting Guide.
5. Restrict where admin tools can reach: block SMB, RPC, WinRM and RDP between workstations and allow them from privileged access workstations or jump hosts only. See the Privileged Access Workstations Guide.
6. Control egress for tunnels and sync: deny outbound connections from servers by default and block anonymity networks and unapproved file sync services at the proxy. See the Anonymity Networks for Defenders Guide.

Decision guidance

• Block or detect: block what the business never uses (Tor, ngrok, unapproved remote support, UACMe and Donut have no admin role in most estates). Detect and baseline what administrators need (Net, PsExec, certutil, AdFind).
• Small organisations: start with one approved remote support tool, ASR rules in block mode after a short audit, and Windows LAPS so a single admin password does not unlock every host.
• Large organisations: add per-group baselines and user and entity behaviour analytics, as the joint guidance suggests, and a detection-as-code pipeline that tests each rule against known admin activity.

Where identity fits

• Admin credentials are the real enabler: PsExec, Winexe and Net only reach other hosts with valid admin rights. Windows LAPS, tiered admin accounts and no domain admin logons to workstations shrink what a single theft gives. See the Local Administrator Password Solution (LAPS) Guide.
• Service accounts run scheduled tasks and scripts: schtasks, at and BITSAdmin jobs often run as service accounts with broad rights. Inventory them, remove interactive logon and alert when they run discovery commands. See How to detect interactive logons by service accounts.
• Directory sync and tenant identities: AADInternals and ROADTools target hybrid identity, federation and tokens. Treat Entra Connect servers and sync accounts as Tier 0. See the Microsoft Entra Connect and Cloud Sync Hardening Guide.
• Remote support and sync tools hold tokens: an RMM agent key or an Rclone configuration file with cloud storage tokens is a machine credential. Store it in a vault and scope it to the minimum.

Measuring coverage

• Percentage of the 59 catalogue tools with at least one tested detection or block (track by sub-group).
• Percentage of Windows endpoints and servers sending process command lines to the SIEM.
• Number of remote support products seen in the estate versus the approved list (target: approved only).
• ASR rule coverage: percentage of devices with the PSExec and WMI rule in block mode.
• Number of servers with unrestricted outbound internet access.
• Median time from a discovery burst alert to analyst triage.

Common failure patterns

• Blocking by file name: renamed copies of PsExec or certutil pass. Use signer, hash or the ASR rule for copied system tools instead.
• Allowlisting every admin tool for everyone: when all users can run Net, AdFind and PsExec, nothing stands out. Scope tools to admin groups and admin hosts.
• Several remote support products and no owner: an unmanaged agent or a portable executable gives attackers a signed backdoor. See the Detecting RustDesk, MeshCentral and Tactical RMM Abuse guide.
• Logs kept only on the host: Wevtutil clears them in one command; forward events in real time.
• Treating hits as "just admins": discovery bursts from a help desk account at 03:00 are closed as noise because the tool is legitimate.

Framework mapping

Practitioner checklist

• Baseline which accounts and hosts legitimately run each catalogue tool.
• Log process command lines and forward them off-host in real time.
• Alert on discovery bursts, new remote services and built-in binaries making outbound requests.
• Enable the ASR rules for PSExec and WMI process creation and for copied system tools, audit first.
• Approve one remote support product, block the rest including portable executables.
• Block workstation-to-workstation SMB, RPC, WinRM and RDP; manage from admin hosts only.
• Deny outbound internet from servers and block anonymity networks and unapproved sync services.
• Deploy Windows LAPS and remove domain admin logons from workstations.
• Protect Entra Connect servers and sync accounts as Tier 0 and alert on federation changes.

Standards and references

• MITRE ATT&CK: Software
• MITRE ATT&CK: PsExec (S0029)
• CISA, NSA, FBI and partners: Identifying and Mitigating Living Off the Land Techniques
• CISA, NSA and MS-ISAC: Protecting Against Malicious Use of Remote Monitoring and Management Software
• Microsoft: Attack surface reduction rules reference
• Microsoft Sysinternals: PsExec
• Microsoft Threat Intelligence: Threat actors misusing Quick Assist in social engineering attacks leading to ransomware
• LOLBAS Project

Related NHI Mgmt Group resources: Living off the Land Guide · ATT&CK Credential and Active Directory Attack Tools Software Hub · ATT&CK C2 and Post-Exploitation Frameworks Software Hub · ATT&CK Remote Access Trojans Software Hub · Discovery and Reconnaissance Techniques Guide