New Dual-Use Software Activity

Dual-use software is easy to acquire and can be leveraged for both legitimate and malicious activity. Malware and advanced persistent threat (APT) groups have been known to install new instances of dual-use software such as AdFind, Rclone, PingCastle, BloodHound, and Impacket to carry out attack objectives. The impact of this activity depends on the type of attack campaign. For example, dual-use software such as AdFind enables reconnaissance while Rclone enables data exfiltration.

The system might change the risk score for this detection.