Critically, he argued that the use of various tools should be instantly flagged as concerning. “Instrument Task Scheduler, PsExec, PsPasswd, and net user are high‑risk signals. These are the insider’s equivalent of lockpicks,” he said. “They should generate behavioral alerts when used at scale, off‑hours, or from unusual hosts.”
Levine also suggested extensive system monitoring. “If someone is RDP’ing into a domain controller at 7:48 a.m. and creating 16 scheduled tasks, you should have a video‑like audit trail.”
Paul Furtado, a distinguished VP analyst at Gartner, said he encourages clients to make sure that no single admin can cause this kind of damage.
