Windows desktop and servers contain a large number of legitimate tools which can also be used by attackers, once they obtain initial access. This presentation describes those tools and their usage in real world attacks.Centralised logging and telemetry provides a wealth of information for blue team members and their day to day operations. These sources usually contain enough data to detect when attackers were successful in compromising the defended network.But how to recognise a successful attack when the tools the attackers are using are also legitimate system administration utilities? Most Windows administrators would agree that PowerShell is an essential system administration tool but it has also been frequently seen as an attack avenue for attackers and red team activities.Powershell is typically used to load code from remote servers and make the attacks “fileless” using reflective dll loading, steal user credentials, pivot within the compromised network, maintain persistence and execute other offensive tasks.Right from the initial compromise, we can expect attackers to use standard Windows tools for enumerating network resources, adding new users, pivoting to other servers, dumping databases, exfiltrating data etc.This session will be a walk through attackers techniques using tools which can also be considered legitimate and are usually installed by default on Windows. We will talk about basic and advanced functionality of this legitimate attack arsenal and show its usage observed during recent attacks.