Multiple Malware Variants Detected on Server Management System

Initial Signal

Microsoft Defender XDR flagged three distinct malware families on the Windows Server 2019 system `ws-001.[INTERNAL_DOMAIN_1].local` between December 21-23, 2025. The detections included TurtleLoader, Leivion (Trojan:Win32/Leivion.K), and Obfuscator (VirTool:SWF/Obfuscator.C), each with unique SHA256 hashes. What made this alert noteworthy was the location pattern: all three malware files were found in `[CUSTOM_DIR_1]` directories with nearly identical path structures (`E:\[CUSTOM_DIR_1]\[GUID]\{GUID}\[GUID]\diffsync\[GUID]`), suggesting they may be related to a differential synchronization process rather than random infections. The consistent naming convention (`pre_completed_ediffcompleted_diff_[FILE_ID].dat`) across all three detections pointed to a systematic infection vector. The investigation correlated data from Microsoft Defender XDR, Microsoft Defender for Endpoint, and Microsoft Entra ID across 10 invocations spanning 2,267 logon events and 2,279 total records. The analysis took 3 minutes 44 seconds to complete, revealing that while the malware was detected, no evidence of execution or post-infection activity appeared in the available telemetry.

How We Reached the Verdict

The agent considered each plausible alternative verdict and ruled them out one at a time. Each card below lists the hypothesis tested, the evidence weighed, and the dismissal rationale.

Disconfirming Evidence

Evidence that pushed against the agent's working hypothesis. Each item changed the direction of the investigation.

Evidence Gathered

The agent queried these data sources during the investigation. Each entry shows what was checked, what came back, and the methodology behind the query.

False Positive Analysis

The agent ran these validation checks to confirm the verdict isn't a false positive.

1. fp1
   Analyzed malware detection specificity and consistency
   Pass
2. fp2
   Evaluated file locations and naming patterns
   Pass
3. fp3
   Assessed likelihood of legitimate files triggering false positives
   Pass

Detection Opportunities

The high-fidelity detection signals from this investigation, sanitized for general use. Each MITRE ID links to the official technique reference.

Verdict Reasoning

The verdict of Malicious at high confidence rests on the following mutually corroborating signals:

1. Three distinct malware families identified with specific threat classifications and unique SHA256 hashes by Microsoft Defender XDR, indicating genuine detections rather than signature misidentification

2. Consistent detection pattern across multiple files with similar naming conventions and identical directory structures, suggesting systematic infection rather than isolated false positives

3. All malware families (TurtleLoader, Leivion, Obfuscator) are known threats with established signatures in threat intelligence databases, not benign files commonly flagged as false positives

4. The system's role as a central management server accessed by multiple service accounts with elevated privileges (SolarWinds, ForeScout, Commvault, Thycotic) amplifies the risk profile, as compromise could enable lateral movement

5. Confidence is rated High rather than Confirmed because the absence of execution evidence and 'Informational' severity classification by Microsoft Defender leave open the possibility that detection and containment occurred before the malware could run, though the presence of the files themselves is unambiguous

Lessons

1. 01
   Severity classification is not a containment guarantee. In this investigation, Microsoft Defender classified all three malware detections as 'Informational' severity, which might suggest low risk. However, the presence of TurtleLoader, Leivion, and Obfuscator on a management server with domain administrator access is a critical finding regardless of severity label. Always investigate the actual threat family and system context, not just the severity score. A low-severity rating on a high-value target (like a management server) requires the same urgency as a high-severity alert on a workstation.
2. 02
   Cache directories are staging grounds, not safe zones. The malware files were found in `[CUSTOM_DIR_1]` cache directories with differential synchronization paths, which might appear benign at first glance. However, cache locations are common staging areas for malware delivery and execution. The fact that files were detected before execution does not mean the infection vector is contained. Investigate how the files arrived in the cache and whether the synchronization process itself is compromised.
3. 03
   Multiple malware families in one location signals coordinated attack. Finding three distinct malware families (TurtleLoader, Leivion, Obfuscator) with identical naming patterns and directory structures is not coincidence. This pattern indicates either a coordinated multi-stage attack or a compromised supply chain feeding malware through the synchronization process. Treat this as evidence of deliberate targeting, not random infection, and escalate to threat hunting on related systems and accounts.
4. 04
   Service account privilege is the real risk multiplier. The system is accessed by SolarWinds, ForeScout, Commvault, and Thycotic service accounts, some with domain administrator privileges. If any of these accounts were used to execute the malware (even if logs don't show it yet), the blast radius extends across the entire infrastructure these tools manage. Audit the service account activity during the detection window and verify that no lateral movement occurred through these privileged accounts.
5. 05
   Absence of execution evidence is not absence of threat. The investigation found no evidence of malware execution in available logs, which might suggest the threat was contained. However, this absence could reflect gaps in telemetry coverage, log retention, or detection capabilities rather than actual containment. Conduct a full forensic examination of the affected system's file system and registry to confirm the malware was not executed, and verify that Microsoft Defender's detection actually prevented execution rather than simply flagging files that were already running.