How do threat actors run their tools?

The question needs some context. We have an application control system where users are only allowed to run certain things, mostly based on signature certificates and approvals by IT.
The assumption is that an adversary shouldn't be able to execute malicious code on a user workstation or server. Assume this is all Windows.


We (small team, medium company) were going through an external report as a simulation exercise where the adversary ran tools like rubeus, mimikatz and python scripts.


What …

adversary application certificates code context control control system cybersecurity malicious question run server signature system things threat threat actors tools windows workstation