If a threat actor has access to a valid OS account, they can utilize existing OS tools and system calls to install malicious code or manipulate device operations. If the account and privileges are not sufficiently restricted, the threat actor may be able to add their own tools, modify other application layer programs, or even execute commands with elevated privileges (e.g., setuid/setgid). Further, threat actors can perform a living-off-the-land attack, where they choose to only use pre-installed functionality and install nothing else on the device. These types of attacks can be hard to detect because malicious behavior may be implemented using tools and functions with legitimate purposes.

• CWE-693: Protection Mechanisms Failure (Pillar)