Once an attacker gains initial access (e.g., through phishing, exploits, or stolen credentials), they quickly shift to LOTL techniques for the bulk of the attack cycle. Here are some of the most commonly misused tools attackers abuse in LOTL campaigns (especially on Windows). .
PowerShell (powershell.exe)
A simple but powerful task automation and configuration management tool, PowerShell is one of the most frequently abused binaries in LOTL attacks, as Huntress documented in detail when analyzing weaponized PowerShell malware.
PowerShell is useful for downloading external payloads (e.g., ransomware), executing malicious scripts, harvesting credentials, and coordinating lateral movement. What's more, attackers can encode or obfuscate their commands to make them more difficult to inspect and detect.
Windows Management Instrumentation (WMI)
WMI is a core Windows management framework that enables administrators to query local metadata, modify system configurations, and manage processes across remote networks. Threat actors weaponize WMI to perform reconnaissance, execute remote commands across network segments, and establish persistent access that survives system reboots.
Certificate Utility (certutil.exe)
This command-line utility manages local security certificates, verifies digital signatures, configures Certificate Services, and dumps CA schema configurations. Because certutil.exe is trusted to download files (such as certificate updates) from remote URLs, attackers abuse it to get around network firewalls and download malicious payloads. It's also used to encode or decode files (often hiding malware within harmless-looking Base64-Encoded text files), allowing attackers to sneak encrypted code past security tools.
Background Intelligent Transfer Service Admin (bitsadmin.exe)
This utility manages BITS, a service that allocates idle bandwidth to background file transfers so that critical operations (e.g., Windows Update) don't disrupt user network performance. While bitsadmin.exe is deprecated in modern Windows, attackers still abuse BITS through PowerShell and COM APIs. BITS transfers are asynchronous, automatically resume if the connection is lost, and run in the background as a trusted system service—all of which make it an ideal tool for attackers to download secondary tools or stealthily exfiltrate data.
Register Server (regsvr32.exe)
Windows natively use this command-line utility to register and unregister Object Linking and Embedding (OLE) controls, including Dynamic Link Libraries (DLLs), in the system registry. Normally, regsvr32.exe looks for local files on the hard drive, but attackers manipulate it to retrieve and execute remote scriptlets without writing traditional malware to disk.
