A command-line utility is a small program run by typing commands into a terminal instead of clicking through a graphical interface. Utilities like file copy, search, text filtering, and process control tools are common examples. They are valued because they are fast, scriptable, and easy to chain together for administration and automation.
In cyber security, command-line utilities matter because they can be both helpful and dangerous. Defenders use them to inspect systems, collect logs, and automate checks. Attackers also abuse them for “living off the land” activity, using built-in or trusted tools to download files, execute commands, or move data while blending in with normal admin work. This is why teams monitor command-line telemetry, maintain allowlists, and set baselines for expected command usage. As platforms adopt more shared tooling, such as Linux-style utilities on Windows, understanding normal command-line behavior becomes even more important.