Dr Jekyll and Mr Hyde: Detecting Attackers Who Use Your Own Admin Tools
Jekyll and Hyde were the same man in two moods. PowerShell, certutil and your remote-support tool are the same binaries whether your admin or an intruder is driving. Living-off-the-land attacks can’t be caught by asking what ran. You have to ask who ran it, how and why.