Trojan:Win32/NativeZone.C!dha

Guidance for end users 

To know more about prevention of supply chain-related attacks and malware in general, refer to the links below:  

• Guarding against supply chain attacks – Part 1: The big picture
• Prevent malware infection 

Guidance for enterprise administrators  

• Turn on cloud-delivered protection in Microsoft Defender Antivirus or the equivalent for your antivirus product to cover rapidly evolving attacker tools and techniques. Cloud-based machine learning protections block a huge majority of new and unknown variants.
• Run EDR in block mode so that Microsoft Defender for Endpoint can block malicious artifacts, even when your non-Microsoft antivirus doesn’t detect the threat or when Microsoft Defender Antivirus is running in passive mode. EDR in block mode works behind the scenes to remediate malicious artifacts that are detected post-breach.
• Enable network protection to prevent applications or users from accessing malicious domains and other malicious content on the internet.
• Enable investigation and remediation in full automated mode to allow Microsoft Defender for Endpoint to take immediate action on alerts to resolve breaches, significantly reducing alert volume.
• Use device discovery to increase your visibility into your network by finding unmanaged devices on your network and onboarding them to Microsoft Defender for Endpoint.
• Enable multifactor authentication (MFA) to mitigate compromised credentials.

NOTE: Microsoft strongly encourages all customers download and use password-less solutions like Microsoft Authenticator to secure your accounts.

• For Office 365 users, see multifactor authentication support.
• For Consumer and Personal email accounts, see how to use two-step verification. 

• Turn on the following attack surface reduction rule to block or audit activity associated with this threat:
  • ​Block all Office applications from creating child processes

Improve your security posture against supply chain attacks

• Software developers and publishers are advised to maintain secure build and update infrastructure and to establish a response process for supply chain attacks. Software updates should always be delivered using SSL connections and signed components.
• Conduct an inventory of your software suppliers. Do your due diligence to confirm there are no red flags. The NIST Cyber Supply Chain Best Practices provide sample questions that you can use to screen your software suppliers, such as what malware protection and detection are performed and what access controls—both cyber and physical—are in place.
• Set a high standard of software assurance with partners and suppliers. Governmental organizations such as the Department of Homeland Security, SAFECode, the OWASP SAMM, and the U.K. National Cyber Security Centre’s Commercial Product Assurance (CPA) provide a model. You can also refer to Microsoft’s secure development lifecycle (SDL). The SDL defines 12 best practices that Microsoft developers and partners utilize to reduce vulnerabilities. Use SDL to guide a software assurance program for your engineers, partners, and suppliers.