Vast majority of tools are dual-use, legitimate software installed by attackers for malicious purposes.