Topic
A technique using scripting engines, admin tools and remote-management software already installed on a system instead of attacker-supplied malware.
According to Microsoft Threat Intelligence, every stage after the consent prompt runs on software the environment already trusts, which puts the choke point on Teams federation policy and remote-support install rights.
Reality
The federal cyber agency now recommends planting fake records, credentials and files across critical infrastructure networks, and its pitch to understaffed teams is that an alert on a decoy needs no analyst to interpret it.
Perspective Coverage
5 publishersReality
Half of respondents to the SANS 2026 Threat Hunting Survey named data quality or quantity as their top hunting barrier. The most cited gaps are cloud and identity logs, the telemetry needed to catch intruders who use administrators' own tools.
Reality
SANS's 2026 hunting survey found 72.7% of hunters who caught nation-state actors saw them living off the land, against 63.4% for ransomware crews. Hunters rank data quality as their top barrier, so detecting misused admin tools starts with the telemetry those hunts depend on.
Reality
Kaspersky's responders found no encrypted files and no malware on disk across the Windows estate of a Middle East manufacturer in April 2026. The impact arrived through one Group Policy Object linked at the domain root.
Reality
Microsoft's September 17 post pins three current campaigns on excessive permissions, open authentication flows and sanctioned admin tooling, and says the change AI brought is the speed at which those combine.
Reality
Bitdefender puts 84% of its high-severity incidents on binaries that were already installed on the host. That figure and Microsoft's ClickFix number cover the two largest volume plays in the telemetry, and both sit outside what attachment scanning and patch cycles reach.
Reality