It's defined in the route. Check out the admin routes in library/XenForo/Route/PrefixAdmin/ directory. Open up "Cron.php" as an example... the 3rd parameter in the getRouteMatch() method is what you are looking for. The "cronEntries" value there corresponds to it's admin navigation entry (under Development tab in ACP), which is a sub-section of Tools. So that's how it knows to stay on the Tools section.