Skip to content
English
Contact us
  • There are no suggestions because the search field is empty.

Commodity Malware Detected [CHK-3033]

This ticket is opened when Microsoft Defender names a piece of commodity malware on an incident in your environment: a dropper, a loader, an information stealer or a remote access trojan (RAT).

Attic MDR treats this as a delivery event, which means the ticket is raised even when Microsoft reports that it already remediated the file. The detail of what was found, on which device, and what Attic has already done is written into the ticket itself by the MDR pipeline.

Rationale

Commodity malware is the mass-market tooling of the criminal ecosystem: families sold or rented to anyone, spread through phishing attachments, malicious advertising and cracked software. It is not targeted, and that is precisely why it is so common.

The important point is what these families are for. A dropper or loader exists to fetch a second payload. An information stealer exists to harvest browser credentials, session cookies and cryptocurrency wallets, and to send them somewhere. A RAT exists to give someone hands-on access. None of them is the end of an attack: each is the beginning of one, and the operator who gets the output frequently sells it on to a ransomware affiliate.

This is why the ticket is raised even after Microsoft blocks the file. Defender remediating a payload tells you that this file was stopped; it does not tell you how it arrived, whether anything ran before detection, or whether credentials were taken in the window beforehand. Stolen session cookies in particular survive a password reset, and remain useful to an attacker long after the malware itself is gone. The delivery event is the thing worth investigating.

Follow-up

Follow these steps to adequately address this detection:

  1. Read what the ticket reports. It names the malware family, the affected device and user, and what Attic has already done. The family determines what to worry about most: a stealer means credentials, a RAT means interactive access.
  2. Establish how it arrived. Check the user's mail for the delivering message, and their browser history and downloads around the detection time. Phishing attachments, fake software downloads and malicious ads are the usual routes.
    • If the malware ran before detection, or you cannot rule it out: Treat the credentials on that device as exposed:
      1. Isolate the device in Microsoft Defender if this has not already been done, and keep it isolated until the timeline is understood.
      2. Reset the user's password and revoke all active sessions in Entra admin center. Session revocation matters more than the password here, because stealers take cookies.
      3. Review other credentials stored on the device (browser-saved passwords, VPN and RDP credentials, SSH keys, cloud CLI tokens) and rotate them.
      4. Check for follow-on activity: new device registrations, MFA method changes, inbox rules, and unusual mailbox or SharePoint access by the affected account.
      5. Reimage rather than clean where a RAT or loader is involved. Removing the detected file does not establish that nothing else was installed.
      6. Escalate to IR if the device is a server, the account is privileged, or you find evidence of a second payload. Contact Attic for incident response support.
    • If Defender blocked delivery outright and nothing executed: The risk is contained, but the delivery attempt still tells you something:
      1. Confirm from the Defender timeline that no process actually ran.
      2. If the route was email, check whether the same message reached other recipients.
      3. Consider whether the user needs support recognising the lure: repeat delivery to the same person is a pattern worth addressing.

More information