Skip to main content
2 of 2
deleted 1 character in body

If you're worried about malicious actors using standard user internal utilities (psexec, pskill) after gaining access to a system, you're worrying about a scenario where no matter what actions are taken in preparation for the intrusion, the attacker will be able to circumvent it, as they already have access to the machine. Making it more difficult to use some of the "power-user" oriented tools on the system will only make it more frustrating for your legitimate users to do their jobs, and won't do anything to prevent the attacker other then mildly inconveniencing them.

However, if you're concerned about tools and utilities that require root/admin level access being used by the attacker after intrusion, you should look into securing your user system (e.g. only giving sudo/admin level access to users signing in with PGP (or if Windows, only from local logins), or only allowing local access to root (only applicable to Linux), etc) instead of trying to limit the tools available in your userspace.