In Your Biggest Security Risk Is What You Already Trust

Modern threat actors increasingly exploit trusted utilities that administrators use daily, turning routine administration into a covert attack vector. Bitdefender’s analysis points to PowerShell, WMIC, netsh, certutil, and MSBuild as common tools leveraged by attackers to move laterally and execute malicious code. The study shows that these utilities can be abused to download payloads, modify system configurations, and bypass security controls. Because these tools are whitelisted by default, defenders often overlook their misuse, creating blind spots in monitoring. Bitdefender recommends implementing strict monitoring of trusted utility usage and enforcing least‑privilege policies to mitigate this risk. The report also suggests incorporating behavioral analytics to detect anomalous activity involving these utilities. By shifting focus from external threats to internal tool abuse, organizations can close a critical security gap. The findings underscore the need for a holistic approach to privileged access management.