When trusted tools become part of the attack chain, the old protection techniques fall short. Here are three that work.