Living off the Land: When the Malware Is Your Own Admin Tools

PowerShell isn't malware. Neither is wmic. When an intruder works with your own administrative tools, the only tell is behavior the host has never shown before.