Attackers exploit pre-installed Windows tools to install and run malicious code; what category is this?

Attackers exploit pre-installed Windows tools to install and run malicious code; what category is this?

• A. Malicious websites
• B. Memory code injection
• C. Legitimate applications
• D. Native applications

Answer: (D)

Using pre-installed Windows tools to install and run malicious code relies on native system binaries. The key idea is that attackers leverate tools that come with the operating system itself, which makes their activity look legitimate to the system and to security tools. This category, native applications, highlights the origin of the tools as built-in OS utilities (like PowerShell, WMI-related tools, certutil, regsvr32, etc.) that are repurposed for malicious actions. Because these binaries are trusted and commonly present on many machines, their misuse can be harder to detect than behavior from unknown software.

Using pre-installed Windows tools to install and run malicious code relies on native system binaries. The key idea is that attackers leverate tools that come with the operating system itself, which makes their activity look legitimate to the system and to security tools. This category, native applications, highlights the origin of the tools as built-in OS utilities (like PowerShell, WMI-related tools, certutil, regsvr32, etc.) that are repurposed for malicious actions. Because these binaries are trusted and commonly present on many machines, their misuse can be harder to detect than behavior from unknown software.