Dual use admin tool
Flags tooling that adversaries lean on heavily but that administrators also run legitimately every day: bulk copy/exfil utilities (rclone)…
What it detects
Flags tooling that adversaries lean on heavily but that administrators also run legitimately every day: bulk copy/exfil utilities (rclone), process-memory tools (ProcDump), tunnelling clients (ngrok), AD enumeration (AdFind), network scanners, and remote-access/RMM products.
These are the entries the threat knowledge base itself rates medium/low. They were previously carried by execution.known_offensive_tool at HIGH, which is miscalibrated for software that appears in normal administration — in an MSP estate that is a guaranteed daily false positive, and it crowds out genuinely unambiguous tooling. Nothing was dropped in the split: every KB signature still fires, ranked as the review candidate it actually is (a lead, not a verdict). A signature the KB rates high stays in the offensive rule and is excluded here, so no event alerts twice.
MITRE ATT&CK mapping
- T1059Command and Scripting Interpreter· Execution
False positives and triage
Every tool here has a legitimate administrative use, so treat a lone hit as context rather than a finding. What makes it suspicious is the surrounding behaviour: an unfamiliar account or host, execution from a scratch directory (Temp / AppData / ProgramData / Downloads), a burst against many hosts, rclone to an unsanctioned cloud destination, or the tool appearing alongside an execution.known_offensive_tool hit on the same entity. Remote-access tooling additionally has a dedicated, better-anchored rule (windows.remote_access.rmm_tool_install) that keys on the command line. Allowlist your sanctioned admin tooling by path once confirmed.
The rule
Declarative YAML read by the detection engine — data, never executed. Confidence 40%. Source: rules/multi/dual_use_admin_tool.yaml, licensed under the Apache License 2.0.
id: execution.dual_use_admin_tool
version: 1.0.0
status: stable
severity: medium
confidence: 0.4
platforms: [windows, linux, macos]
mitre_techniques: [T1059]
description: |
Flags tooling that adversaries lean on heavily but that administrators also run
legitimately every day: bulk copy/exfil utilities (rclone), process-memory tools
(ProcDump), tunnelling clients (ngrok), AD enumeration (AdFind), network scanners,
and remote-access/RMM products.
These are the entries the threat knowledge base itself rates medium/low. They were
previously carried by execution.known_offensive_tool at HIGH, which is miscalibrated
for software that appears in normal administration — in an MSP estate that is a
guaranteed daily false positive, and it crowds out genuinely unambiguous tooling.
Nothing was dropped in the split: every KB signature still fires, ranked as the
review candidate it actually is (ADR-004 — a lead, not a verdict). A signature the KB
rates high stays in the offensive rule and is excluded here, so no event alerts twice.
match:
raw_message_contains_any:
# Credential Access
- "procdump"
- "procdump64"
# Discovery
- "adfind"
- "advanced ip scanner"
- "advanced_ip_scanner"
- "angry ip scanner"
- "angryip"
- "invoke-sharpview"
- "netscan"
- "softperfect"
# Exfiltration
- "rclone"
# Lateral Movement
- "anydesk"
- "atera"
- "connectwise"
- "screenconnect"
- "splashtop"
- "teamviewer"
# Tunneling
- "ngrok"
false_positive_guidance: |
Every tool here has a legitimate administrative use, so treat a lone hit as context
rather than a finding. What makes it suspicious is the surrounding behaviour: an
unfamiliar account or host, execution from a scratch directory (Temp / AppData /
ProgramData / Downloads), a burst against many hosts, rclone to an unsanctioned cloud
destination, or the tool appearing alongside an execution.known_offensive_tool hit on
the same entity. Remote-access tooling additionally has a dedicated, better-anchored
rule (windows.remote_access.rmm_tool_install) that keys on the command line.
Allowlist your sanctioned admin tooling by path once confirmed.
Related detections
Run this rule on your own logs — offline
KIROSEC runs this rule and the rest of the library over Windows, Linux, macOS and cloud audit logs on the analyst's own machine. Every alert links to the events that raised it, and nothing leaves the device.