---
sourceDocument: Australia Security Management
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/security-management

 Release :

    - australia

ft:locale :

    - en-US

ft:publication_title :

    - Australia Security Management

ft:clusterId :

    - security

bundleId :

    - security

workflow :

    - Technology


---

# Tools

# Tools {#ariaid-title1}

* Release version: Australia
* 
* Updated March 12, 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read

Tools are legitimate software that are used by threat actors to perform attacks. Tools apply for STIX 2.x.

Tools enable you to know how and when threat actors use them for executing campaigns. Unlike malware, these tools or software packages are often found on a system and have legitimate purposes for power users, administrators, network
administrators, or even normal users.

For example, remote access tools (RDP) and network scanning tools (Nmap) are tools that a threat actor uses during an attack.
* **[Define Tools](https://servicenow-prod.fluidtopics.net/Sfp905rNoGB6QRYJ3c8Khg)**   
  Define tools as legitimate software that is used to perform attacks.