During incident response, the team discovers the attacker used only…

Question

During incident response, the team discovers the attacker used only built-in Windows tools including certutil, bitsadmin, and mshta. Why does this complicate traditional IR approaches?

Accepted Answer

Living-off-the-land techniques evade signature-based detection because the tools are legitimate; detection requires behavioral analysis and contextual log review — Here's the deal — b is correct because LOLBAS attacks use legitimate system tools, bypassing antivirus and signature-based IDS. Detection requires behavioral baselines, command-line argument logging via Sysmon, and SIEM correlation of anomalous tool usage.

Answer

These built-in tools are encrypted by Windows and cannot be examined by incident responders

Answer

Windows built-in tools leave no logs whatsoever, making investigation impossible

Answer

These techniques only work against Windows XP, indicating the organization runs dangerously outdated systems

During incident response, the team discovers the attacker used only built-in Windows tools including certutil, bitsadmin, and mshta. Why does this complicate traditional IR approaches?

Short Explanation and Infographic

Full Explanation