What term describes attackers exploiting pre-installed tools on Windows to install and run malicious code?

What term describes attackers exploiting pre-installed tools on Windows to install and run malicious code?

• A. Native applications
• B. Legitimate applications
• C. Fileless malware
• D. PowerShell abuse

Answer: (A)

Leveraging built-in Windows tools to install and run malicious code centers on native applications—the software that already ships with the operating system. Attackers reuse these pre-installed utilities to execute payloads, download additional components, or run commands, which helps them blend in with normal activity and often avoids triggering alarms set for unfamiliar software. Because the focus is on using what is already present on the system rather than introducing new tools, the broad term that fits best is native applications. While PowerShell abuse is a real example of this tactic, it describes a specific tool being misused rather than the general idea of exploiting pre-installed tools. Fileless malware relates to staying in memory or using living-off-the-land techniques, which can involve native tools but is not the exact term for the concept described. Legitimate applications don’t imply misuse, so they don’t capture the malicious exploitation described.

Leveraging built-in Windows tools to install and run malicious code centers on native applications—the software that already ships with the operating system. Attackers reuse these pre-installed utilities to execute payloads, download additional components, or run commands, which helps them blend in with normal activity and often avoids triggering alarms set for unfamiliar software. Because the focus is on using what is already present on the system rather than introducing new tools, the broad term that fits best is native applications.

While PowerShell abuse is a real example of this tactic, it describes a specific tool being misused rather than the general idea of exploiting pre-installed tools. Fileless malware relates to staying in memory or using living-off-the-land techniques, which can involve native tools but is not the exact term for the concept described. Legitimate applications don’t imply misuse, so they don’t capture the malicious exploitation described.