2024 Sees Sharp Increase in Microsoft Tool Exploits

**Executive summary:** Sophos' Active Adversary Report for H1 2024 documents a 51% rise in abuse of legitimate Microsoft tools (187 unique LOLbins observed, with RDP abuse in ~89% of cases), a slight decline but continued dominance of LockBit (21% of incidents), an increase in artifacts on systems (from 205 to 230), and a shift in root causes from compromised credentials (down from 56% to 39%) toward vulnerability exploitation (up to 30.5%).