In my company (And many others around the world) there is a wide usage by tech teams of tools such as ipscanners, psexec, pskill and other tools.
How do you deal or control the usage of such tools in your environment?
It's common for threat actors after an intrusion to use internal administration tools that are already available within servers and workstations, I would like to prevent.
If you're worried about malicious actors using standard user internal utilities (psexec, pskill) after gaining access to a system, you're worrying about a scenario where no matter what actions are taken in preparation for the intrusion, the attacker will be able to circumvent it, as they already have access to the machine. Making it more difficult to use some of the "power-user" oriented tools on the system will only make it more frustrating for your legitimate users to do their jobs, and won't do anything to prevent the attacker other then mildly inconveniencing them.
However, if you're concerned about tools and utilities that require root/admin level access being used by the attacker after intrusion, you should look into securing your user system (e.g. only giving sudo/admin level access to users signing in with PGP (or if Windows, only from local logins), or only allowing local access to root (only applicable to Linux), etc) instead of trying to limit the tools available in your userspace.
The most effective thing that can be done to mitigate the use of these types of tools internally is to create a strong Acceptable Use Policy. Then, once approved by deciding authorities, enforce it by having employees sign it.
You should have two AUP documents in place, one for regular end-users, and one (or an additional one) for IT users. This allows you to control which users are allowed to have these types of tools installed.
If you are worried about these types of tools being used against your own network internally, I would recommend full-disk encryption on the machines that have them installed, and have the users shut the machines down after business hours are over.
If you are looking for a technical resource, I would recommend application white-listing. In our organization, we simply use a spice works report once daily to let us know about any applications on our network. Though not a complete solution, it helps us stay on top of things.
