Pre-installed Windows tools like PowerShell and WMI that attackers exploit to install and run malicious code are known as which category?

Pre-installed Windows tools like PowerShell and WMI that attackers exploit to install and run malicious code are known as which category?

• A. Native applications
• B. Legitimate applications
• C. Malicious websites
• D. Script-based injection

Answer: (A)

Built-in Windows utilities that attackers abuse to carry out malicious actions are considered native to the operating system. These tools come packaged with Windows and run as trusted components of the system, which is why they’re available for use by both administrators and attackers alike. PowerShell and WMI are prime examples because they’re powerful, legitimate tools included with Windows, capable of executing commands, scripting, and remote management. When attackers abuse these native tools, they can install and run malware without introducing overtly malicious binaries that might be flagged by some defenses. That’s why the category emphasized here is native applications: they’re part of the OS, trusted by the system, and frequently exploited due to their heavy capabilities.

Built-in Windows utilities that attackers abuse to carry out malicious actions are considered native to the operating system. These tools come packaged with Windows and run as trusted components of the system, which is why they’re available for use by both administrators and attackers alike. PowerShell and WMI are prime examples because they’re powerful, legitimate tools included with Windows, capable of executing commands, scripting, and remote management. When attackers abuse these native tools, they can install and run malware without introducing overtly malicious binaries that might be flagged by some defenses. That’s why the category emphasized here is native applications: they’re part of the OS, trusted by the system, and frequently exploited due to their heavy capabilities.