ASD Essentials IT.DET-04.1 Continuously Monitor Software Execution to Detect Malicious Use of Legitimate Tools
What it says
Continuously monitor and analyse software execution behaviour on systems to detect where legitimate tools and utilities are being used for malicious purposes.
Quoted as published. Everything else on this page is written by Control Stack.
What it means
In plain EnglishKeeps watching and analysing how software runs on systems, to catch attackers misusing legitimate tools and utilities, such as built-in admin tools.
Servers and network devices come with powerful built-in tools, such as command shells and scripting tools. Attackers use these same tools, often with a stolen account, because it looks like routine IT work. To meet this, the organisation lists the tools most open to misuse. It constantly watches and analyses how they run on internet-facing, sign-in, critical and admin systems. Unusual use raises an alert that is checked within a set time.
Free. Save your status, tasks and notes.
Where this action applies
What's in each domain?ASD orders the work by domain: apply this action to each ticked domain, phase by phase.
- Phase 3
- Business systems (does not apply)
- User devices (does not apply)
Why it matters
Without this monitoring, intruders can roam and take over key systems unseen. They can gain lasting or admin access across the organisation and disrupt critical services before anyone notices.
How to implement
The security operations lead should list the legitimate tools most open to misuse, such as scripting tools, command shells and remote admin tools.
Record the risky behaviours too, and who normally uses each tool and when.
Platform teams should constantly collect activity data from every in-scope system, such as each program start with its full command line, and script logs.
Use device logs where monitoring software cannot be installed.
Detection engineers should build rules and behaviour analysis that flag unusual use, using context such as account, server role and the program that started it.
Test each rule by safely reproducing the behaviour.
The security operations team should set times to check and investigate alerts, based on each alert's risk.
Track every alert in a case system against those times, and pass confirmed misuse to incident response.
The security operations lead should review coverage on a set schedule, and when systems, threat intelligence, observed attacks or the organisation's risks change.
Map priority tools against activity data and rules, and give each gap an owner.
Keep it running
Security operations runs this as an always-on service. It alerts when any in-scope system stops sending activity data. Before closing an alert, it checks it against approved changes and the account's normal pattern. Follow ASD's priority order: internet-facing and sign-in systems first, then critical and admin systems. Admin tools run daily on admin systems, so set what normal looks like for each account and server.
Evidence and audit
- Check 1 of 5What an auditor asks for
Ask for
Ask for the list of high-risk legitimate tools and behaviours, with each one's expected use.
Look at
Whether a list exists for internet-facing, sign-in, critical and admin systems, or misses types such as scripting tools.
Good evidence
High-risk tools are listed for each ASD domain in scope, with their normal users and use.
- Check 2 of 5What an auditor asks for
Ask for
Request a report of which in-scope systems send activity data to central logging.
Look at
Whether high-risk systems, such as directory or admin access servers, send nothing, or their data lacks command lines.
Good evidence
Activity data flows constantly from every in-scope system, with other analysis where monitoring software cannot run.
- Check 3 of 5What an auditor asks for
Ask for
Ask for the detection rules for each priority tool, with recent test results.
Look at
Whether data is collected but never analysed, or rules are switched off, untested or missing context.
Good evidence
Every priority tool has working rules that use context to flag unusual use, proven by testing.
- Check 4 of 5What an auditor asks for
Ask for
Ask for the risk-based alert handling times and a sample of recent alerts with case records.
Look at
Whether alerts were left unchecked, closed without explanation, or handled outside the set times.
Good evidence
Each alert was ranked by risk and investigated on time, with a recorded outcome.
- Check 5 of 5What an auditor asks for
Ask for
Request the latest coverage review, its map of tools to rules and the gaps it found.
Look at
Whether coverage was last reviewed at the first build, changes triggered no review, or gaps lack owners.
Good evidence
Reviews run on schedule and after triggers, and each gap is closed by its named owner.
ASD indicators of good practice (9)
The indicators below are quoted as published from ASD's Assessment evidence guide for enterprise IT. These optional indicators help an assessor judge the action in each domain where it applies: if any not effective statement is true, the action is rated not effective; if every applicable fully effective statement is true and no other statement is, it is rated fully effective; otherwise it is rated partially effective. ASD says the indicators "do not replace expert judgement, nor are they intended to serve as a checklist".
Not effective(2)
- NE-1No monitoring or equivalent analysis is used to identify anomalous or unexpected use of legitimate tools and utilities on applicable systems.
- NE-2Existing controls do not provide a reasonable capability to detect security-relevant patterns of legitimate software being used for malicious purposes.
Partially effective(3)
- PE-1Monitoring or equivalent analysis covers some priority tools, execution behaviours or applicable systems, but risk-significant coverage gaps exist.
- PE-2Security-relevant execution telemetry is collected, but detection rules, behavioural analytics or equivalent analysis are incomplete or not consistently operational.
- PE-3Alerts relating to anomalous or unexpected software execution are generated, but they are not consistently triaged and investigated within organisationally defined timeframes.
Fully effective(4)
- FE-1The organisation identifies the legitimate tools, utilities and execution behaviours that present heightened risk of malicious use within applicable systems.
- FE-2Security-relevant telemetry and contextual information are analysed using detection rules, behavioural analytics or equivalent methods to identify anomalous or unexpected use of priority tools and utilities.
- FE-3Detection coverage is periodically reviewed and adjusted in response to changes in applicable systems, threat intelligence, observed activity and the organisation’s risk profile.
- FE-4Alerts are prioritised, triaged and investigated within timeframes defined according to their assessed security risk.
Mappings
Closest match in ISO/IEC 27001: A.8.16, Monitoring Networks and Systems for Anomalous Behaviour, which this control partially meets.
ISO/IEC 27001: 2 mappings
This control partially meets A.8.16.
IT.DET-04.1 requires software execution behaviour on systems to be continuously monitored and analysed to detect legitimate tools and utilities being used for malicious purposes. This is a specific form of the monitoring for anomalous behaviour that Annex A 8.16 requires across networks, systems and applications. Annex A 8.16 is broader in coverage and also requires appropriate action to evaluate potential incidents, while IT.DET-04.1 focuses on the malicious use of legitimate tools.
This control partially overlaps A.8.18.
IT.DET-04.1 requires continuous monitoring and analysis of software execution behaviour to detect legitimate tools and utilities being used for malicious purposes. This detective measure strengthens Annex A 8.18, which requires the use of utility programs capable of overriding system and application controls to be restricted and tightly controlled, by revealing misuse that restrictions alone may not prevent. Annex A 8.18 is primarily preventive and limited to such utility programs, while IT.DET-04.1 covers legitimate tools and utilities more generally.
ASD Essential Eight: 10 mappings
This control partially overlaps E8-AC-ML2.5.
IT.DET-04.1 requires continuous monitoring and analysis of software execution to detect malicious use of legitimate tools; E8-AC-ML2.5 requires allowed and blocked application control events to be centrally logged, a source of execution data for that analysis.
This control partially overlaps E8-AC-ML2.8.
IT.DET-04.1 requires continuous monitoring and analysis of software execution to detect malicious use of legitimate tools; E8-AC-ML2.8 (application control) requires timely analysis of cyber security events to identify incidents, overlapping on event analysis.
This control partially overlaps E8-AC-ML3.4.
IT.DET-04.1 requires continuous monitoring and analysis of software execution to detect malicious use of legitimate tools; E8-AC-ML3.4 (application control) requires timely analysis of event logs from non-internet-facing servers, a related detection duty.
- E8-AH-ML2.11Centrally log PowerShell module, script block, and transcription eventsPartially overlaps
This control partially overlaps E8-AH-ML2.11.
IT.DET-04.1 requires continuous monitoring and analysis of software execution to detect malicious use of legitimate tools; E8-AH-ML2.11 requires PowerShell module logging, script block logging and transcription events to be centrally logged, a data source for that analysis.
This control partially overlaps E8-AH-ML2.15.
IT.DET-04.1 requires continuous monitoring and analysis of software execution to detect malicious use of legitimate tools; E8-AH-ML2.15 (user application hardening) requires timely analysis of cyber security events to identify incidents, overlapping on event analysis.
This control partially overlaps E8-AH-ML3.4.
IT.DET-04.1 requires continuous monitoring and analysis of software execution to detect malicious use of legitimate tools; E8-AH-ML3.4 (user application hardening) requires timely analysis of event logs from non-internet-facing servers, a related detection duty.
This control partially overlaps E8-MF-ML2.9.
IT.DET-04.1 requires continuous monitoring and analysis of software execution to detect malicious use of legitimate tools; E8-MF-ML2.9 (multi-factor authentication) requires timely analysis of cyber security events to identify incidents, overlapping on event analysis.
- E8-MF-ML3.4Analyse event logs from non-internet-facing servers timely to detect security eventsPartially overlaps
This control partially overlaps E8-MF-ML3.4.
IT.DET-04.1 requires continuous monitoring and analysis of software execution to detect malicious use of legitimate tools; E8-MF-ML3.4 (multi-factor authentication) requires timely analysis of event logs from non-internet-facing servers, a related detection duty.
This control partially overlaps E8-RA-ML2.10.
IT.DET-04.1 requires continuous monitoring and analysis of software execution to detect malicious use of legitimate tools; E8-RA-ML2.10 (restrict administrative privileges) requires timely analysis of cyber security events to identify incidents, overlapping on event analysis.
This control partially overlaps E8-RA-ML3.8.
IT.DET-04.1 requires continuous monitoring and analysis of software execution to detect malicious use of legitimate tools; E8-RA-ML3.8 (restrict administrative privileges) requires timely analysis of event logs from non-internet-facing servers, a related detection duty.
Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.