What 45 Days of Watching Your Own Tools Will Tell You About Your Real Attack Surface

Legitimate utilities used for administration are also commonly used by threat actors, making many intrusions look like normal activity rather than malware. Analysis of 700,000 high-severity incidents found legitimate-tool abuse in 84% of them. A 45-day Internal Attack Surface Assessment helps organizations convert “living off the land” risk into a prioritized list of users, endpoints, and tools to remove safely. A clean Windows 11 install includes many living-off-the-land binaries, and PowerShell is active on most endpoints, often invoked silently by third-party applications. The approach is framed as an over-entitlement problem that cannot be solved by patching alone, and as a response to the speed of modern intrusions.

"The most dangerous activity inside most organizations no longer looks like an attack. It looks like administration. PowerShell, WMIC, netsh, Certutil, MSBuild - the same trusted utilities your IT team uses every day are also the preferred toolkit of modern threat actors. Bitdefender's analysis of 700,000 high-severity incidents found legitimate-tool abuse in 84% of them."

"That's what Bitdefender's complimentary Internal Attack Surface Assessment is built to answer. It's a 45-day, low-effort engagement available to organizations with 250 or more employees that turns the abstract problem of "living off the land" into a specific, prioritized list of users, endpoints, and tools you can safely take away from attackers without breaking the business."

"A clean Windows 11 install ships with 133 unique living-off-the-land binaries spread across 987 instances. Bitdefender Labs telemetry found PowerShell active on 73% of endpoints, much of it invoked silently by third-party applications. This isn't a malware problem - it's an over-entitlement problem, and you can't patch your way out of it."

"Gartner now projects that preemptive cybersecurity will account for 50% of IT security spending by 2030, up from less than 5% in 2024, and that 60% of large enterprises will adopt dynamic attack surface reduction (DASR) technologies by 2030, up from less than 10% in 2025. The reason is mechanical: when most intrusions involve no malware and adversaries move in minutes, "detect and respond" is too slow a loop. You have to remove the moves attackers can make in the first place."

Read at The Hacker News