- malware
- endpoint-compromise
- privilege-escalation
- persistence
- multi-endpoint
Trojan:BAT/Starter.G!lnk Malware Detected Across 9 Endpoints with Domain Admin Access
Microsoft Defender detected Trojan:BAT/Starter.G!lnk malware on endpoint ws-001 with suspicious domain administrator remote access preceding detection. The malware appeared on 9 organizational endpoints with polymorphic naming patterns and low global prevalence, indicating a targeted attack.
Time and cost estimates are based on a Tier-2 SOC analyst model and actual investigation telemetry. Individual results vary by analyst experience, tooling, and environment.
Initial Signal
On March 20, 2026, Microsoft Defender for Endpoint detected Trojan:BAT/Starter.G!lnk malware on endpoint ws-001.[INTERNAL_DOMAIN_1].local ([MDE_MACHINE_ID_1]), mapping to MITRE technique T1547.001 (Registry Run Keys / Startup Folder). The alert fired on the file `[CUSTOM_FILE_1].bat` located in the non-standard directory `C:\[CUSTOM_DIR_1]\[CUSTOM_DIR_2]` — a path with no legitimate business purpose.
What made this signal stand out was not just the malware classification itself, but the temporal sequence: domain administrator account [INTERNAL_DOMAIN_1]\\user_3 accessed the machine via RemoteInteractive logon at 06:59:57Z, and malware detection occurred at 07:07:27Z, only 7 minutes later. The file also exhibited polymorphic naming across 9 organizational endpoints, suggesting deliberate obfuscation rather than a one-off incident.
The investigation correlated Microsoft Defender for Endpoint alerts, logon events, and file prevalence data across 9 invocations and 74 records in 3 minutes 1 second of autonomous analysis, revealing a pattern consistent with either a compromised privileged account or an authorized administrator who inadvertently introduced malware into the environment.
How We Reached the Verdict
The agent considered each plausible alternative verdict and ruled them out one at a time. Each card below lists the hypothesis tested, the evidence weighed, and the dismissal rationale.
Could this be a false positive?
Ruled outCould this be a true positive that was blocked?
Ruled outCould this be an account compromise?
Ruled out[INTERNAL_DOMAIN_1]\user_3) was compromised rather than being used by an authorized administrator who inadvertently introduced malware. The evidence strongly suggests malicious activity but doesn't definitively prove unauthorized use of the domain administrator account versus an authorized administrator making a security error. The malware detection and domain administrator access are temporally correlated but causation cannot be conclusively established from the available evidence.·Medium confidenceDisconfirming Evidence
Evidence that pushed against the agent's working hypothesis. Each item changed the direction of the investigation.
Evidence Gathered
The agent queried these data sources during the investigation. Each entry shows what was checked, what came back, and the methodology behind the query.
[CUSTOM_FILE_1].bat) in non-standard directory C:\[CUSTOM_DIR_1]\[CUSTOM_DIR_2]00ae146acabcffc9c304aa1e0f12330a04db4b2e has low global prevalence (89 instances) and appeared on 9 distinct endpoints in the organization[INTERNAL_DOMAIN_1]\user_3 accessed the machine via RemoteInteractive and Network logon types at 06:59:52Z-06:59:57Z on 2026-03-20[INTERNAL_DOMAIN_1]\user_2 at 06:50:31Z preceded the domain administrator access[INTERNAL_DOMAIN_1]\user_1 was active on the system from 2026-02-20 through 2026-03-20 06:43:03ZFalse Positive Analysis
The agent ran these validation checks to confirm the verdict isn't a false positive.
- fp1Verified the file is genuinely malicious based on Microsoft Defender classificationPass
- fp2Analyzed file prevalence and naming patterns within the organizationPass
- fp3Examined temporal correlation with user login activityPass
- fp4Evaluated whether the file could be a legitimate security toolPass
Detection Opportunities
The high-fidelity detection signals from this investigation, sanitized for general use. Each MITRE ID links to the official technique reference.
| Technique | Tactic | Context |
|---|---|---|
T1547.001Registry Run Keys / Startup Folder | Persistence | Flag unsigned .bat and .exe files in non-standard directories such as C:\[CUSTOM_DIR_1]\[CUSTOM_DIR_2] that attempt to modify HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run or similar persistence registry paths. Alert on polymorphic file naming patterns where the same file hash appears under 5 or more different filenames within a short timeframe, especially when combined with low global prevalence (under 100 instances). Monitor for domain administrator accounts executing or accessing these files via RemoteInteractive logon within 10 minutes of file creation or first detection. |
T1078.002Valid Accounts - Domain Accounts | Lateral Movement | Alert on sequences where a standard user account is followed by brief access from a second account, then domain administrator remote access via RemoteInteractive logon within 20 minutes. Flag domain administrator accounts accessing machines outside normal business hours or from unusual IP addresses. Correlate RemoteInteractive and Network logon types for the same privileged account within a 10-minute window, as this pattern suggests lateral movement or credential misuse. |
Verdict Reasoning
The verdict of Malicious at high confidence rests on the following mutually corroborating signals:
1. Microsoft Defender classified the file as Trojan:BAT/Starter.G!lnk with high confidence, and the file is unsigned with no publisher information, ruling out legitimate software
2. The file exhibited polymorphic naming (5 different filenames including .bat and .exe variants) across 9 organizational endpoints, a pattern inconsistent with false positives or benign tools
3. Global prevalence of only 89 instances combined with presence on 9 organizational endpoints (approximately 10% of the organization) indicates targeted malicious activity rather than widespread commodity malware
4. The temporal correlation between domain administrator remote access at 06:59:57Z and malware detection at 07:07:27Z (7 minutes later) suggests either account compromise or an authorized administrator inadvertently introducing malware
5. The file's location in non-standard directory C:\[CUSTOM_DIR_1]\[CUSTOM_DIR_2] with no legitimate business purpose further supports malicious intent. Confidence is High rather than Confirmed because the available telemetry does not definitively establish whether the domain administrator account was compromised or whether an authorized user made a security error; the evidence strongly indicates malicious activity but stops short of conclusively proving unauthorized account use."
Lessons
- 01Polymorphic naming is a strong signal of deliberate obfuscation. In this investigation, the same file hash appeared under 5 different filenames across 9 endpoints. This polymorphic behavior is not typical of legitimate software updates or patches, which use consistent naming conventions. When you see the same hash with multiple names, especially .bat and .exe variants in non-standard directories, escalate immediately. The naming variation is the attacker's attempt to evade signature-based detection and suggests intentional malicious activity, not a false positive or benign tool.
- 02Temporal proximity between privileged access and malware detection is a pivot point. Domain administrator
[INTERNAL_DOMAIN_1]\user_3 accessed the endpoint 7 minutes before malware detection. This tight correlation is not coincidental. Always cross-reference login events with alert timestamps, especially for privileged accounts. If a domain admin accesses a machine and malware appears within 15 minutes, investigate whether the account was compromised, whether the admin inadvertently introduced the malware, or whether the malware was already present and the admin access triggered detection. This temporal signal should trigger credential reset and account audit procedures. - 03Prevention on one endpoint does not mean containment across the organization. Microsoft Defender blocked execution on
ws-001, which looked like a win. But the malware was already present on 9 endpoints. The blocked count is a distraction from the real scope. Always ask: if this file is on 9 machines, how many executed successfully before we detected it? How many are still undetected? The prevention status on a single endpoint should trigger an immediate organization-wide hunt for the same file hash, not closure of the incident. - 04Low global prevalence combined with organizational spread indicates targeted activity. This file had only 89 instances globally but appeared on 9 of your endpoints. That's a 10% organizational infection rate for a file almost nobody else has seen. This ratio is the signature of a targeted attack, not a commodity malware or false positive. When you see low global prevalence paired with high organizational prevalence, assume the attacker selected your organization deliberately and escalate to threat hunting and incident response teams immediately.
- 05Unsigned files in non-standard paths warrant immediate isolation. The file
[CUSTOM_FILE_1].bat was unsigned, non-PE (likely a script), and located in C:\[CUSTOM_DIR_1]\[CUSTOM_DIR_2]— a path with no legitimate business purpose. Unsigned scripts in non-standard directories are a classic persistence mechanism. Before waiting for additional evidence, isolate affected endpoints from the network and preserve forensic images. The combination of unsigned status, non-standard path, and malware classification is sufficient to justify immediate containment actions.