We're gradually updating threat actor names in our reports to align with the new weather-themed taxonomy. Learn about Microsoft threat actor names
Trojan:PowerShell/Metasploit!MSR
Aliases: No associated aliases
Summary
Trojan:PowerShell/Metasploit!MSR identifies as a PowerShell script that maliciously contains delivery and installation mechanism for the Metasploit Framework's payload. This threat abuses the deep Windows system integration and trusted status of PowerShell to launch its attack sequence. Its primary objective is to deploy a memory-resident Meterpreter agent, which operates without installing files on the disk, thereby evading traditional signature-based detection. A classic example of living-of-the-land (LOLBins) employed, as threat actors use PowerShell for malware propagation.
A successful breach establishes a reverse shell connection to a threat actor-controlled server, granting them extensive remote control over the compromised Windows device. This level of access facilitates a severe security compromise, allowing data theft, surveillance, lateral movement within networks, and the deployment of secondary payloads such as ransomware.
- Disconnect the compromised device from all networks (both wired and Wi-Fi) as soon as possible. This severs the threat actor’s remote connection and prevents further data exfiltration.
- Inspect startup entries, scheduled tasks, and running processes for any malicious components that may have established persistence.
- Reset all web browsers to their default settings to remove any malicious extensions, changes to your homepage, or search engine hijackers that the malware may have installed.
- Check and clean Windows Scheduled Tasks and the HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run registry key for any malicious entries established by the malware.
- Check and clean startup entries, scheduled tasks, and running processes for any components the malware may have used to maintain persistence.
- Examine financial, messaging, and essential platforms for atypical transactions indicative of unauthorized entry.
- Change passwords for local user profiles, privileged accounts, and linked online services immediately, as they may have been intercepted.
Microsoft Defender Antivirus automatically removes threats as they are detected. However, many infections can leave remnant files and system changes. Updating your antimalware definitions and running a full scan might help address these remnant artifacts.
You can also visit our advanced troubleshooting page or search the Microsoft virus and malware community for more help.
