A security agent detected suspicious software on a desktop used by the Admin account; the event was rated high risk due to the software's malicious reputation and potential to harm systems. The threat was successfully mitigated and quarantined on the device, so immediate risk to the network is low. Business impact could include temporary loss of that user’s productivity and a small operational disruption if similar software was present elsewhere.
SOC Response Actions Actions the SOC performed (or attempted). Follow this link for further information on Use Case #5 and Use Case #6. ActionStatus
--- --- Savoy-DskTop, no full disk scan command was sent. Not Configured Savoy-DskTop, endpoint was not isolated from the network. Not Configured
Recommended Remediation
[Containment] Isolate the affected endpoint 'Savoy-DskTop' from the network until remediation is complete.
[Eradication] Remove the file \Device\HarddiskVolume3\Users\Admin\Downloads\Setup_WebCompanion.exe from the endpoint and delete associated file hashes '4bb16776c33eb099f170c2204279268cf79a55ebd12891a114f63e11b0237b2c' and 'bc457fa758af1f9f1cceb1504b8d15f4cbbd5b77' from central file shares.
[Hardening] Ensure the user 'Admin' does not run with unnecessary local administrative privileges; apply least-privilege controls for this account.
[Hardening] Block execution of installers from the Downloads folder via AppLocker or Microsoft Defender Application Control policies.
[Hardening] Validate and revoke any untrusted certificates or signed software sources matching publisher 'LAVASOFT SOFTWARE CANADA INC.' until provenance is confirmed.
