Trojan:Win32/Commando.A!ml: What It Means and How to Stop Repeated Alerts

Trojan:Win32/Commando.A!ml is a Microsoft Defender detection label, not enough by itself to identify one malware family. Treat it as a real infection when the affected item shows hidden PowerShell, ExecutionPolicy Bypass, an encoded command, an unknown network destination, or alerts that return after removal. A legitimate script can trigger the same label, but only when its source, signature, purpose, and behavior are independently verified. If Defender says Status: Removed and the alert appears again, assume another task, startup entry, script, or dropper is relaunching the detected command until you prove otherwise.

What Trojan:Win32/Commando.A!ml means

Microsoft classifies the alert as a Windows trojan and says the threat can perform actions selected by a malicious actor. Its public encyclopedia entry does not provide aliases or technical behavior for this exact name [1]. That means the alert name is a starting point, not a complete incident report.

Read the name in parts:

The Affected items field is more useful than the label alone. If it shows a random executable in Downloads or Temp, investigate that file and its source. If it shows the legitimate Windows powershell.exe, do not delete PowerShell: inspect the complete command line and find what launched it.

Why the alert returns after Defender says Removed

Defender can remove or quarantine the object it sees at one moment while a separate persistence mechanism survives. The next scheduled launch creates the same behavior again, so Protection History records a new event. Alerts every few seconds are therefore stronger evidence of an active launcher than of one file that Defender “failed to delete.”

1. A scheduled task, startup item, service, browser-triggered script, or original dropper launches a command.
2. Defender blocks that execution and reports Removed or Quarantined.
3. The persistence mechanism reaches its next trigger.
4. The command is rebuilt or launched again, producing another alert.

Repeated detection does not automatically identify the persistence location. It tells you to look beyond the item Defender just removed. The trigger may be in Task Scheduler, a Run key, a startup folder, a service, a WMI subscription, a malicious browser notification chain, or the application that originally delivered the script.

When the affected item is hidden, encoded PowerShell

In the incident that prompted this guide, Defender showed the normal Windows PowerShell path but also displayed command-line flags that hid the window, bypassed the current script policy, and supplied a Base64-encoded command. Safe decoding for analysis showed that the command built a JSON profile of the Windows host, sent it to a remote endpoint, and was designed to execute the server response.

That combination is high-confidence malicious behavior. None of these details should be judged in isolation—administrators can legitimately encode or hide scripts—but an unknown callback, host profiling, direct execution of a response, and rapid recurrence remove the normal administrative context.

The sanitized callback and later artifacts match the TookPS/OkoBot execution pattern documented in our OkoBot/TookPS technical analysis. That Labs report holds the campaign-level indicators. This page focuses on what an affected Windows user should do with the Defender alert.

Real infection or false positive?

Use the whole event context. Do not restore the item or add an exclusion just because someone else saw the same name on a clean tool.

If the evidence points to a known clean program, keep the original quarantined while you verify it. Submit the file, its hash, or Defender diagnostic package to Microsoft and select the clean/false-positive classification; Microsoft documents both file and fileless submission routes [3]. Do not solve uncertainty with a folder-wide antivirus exclusion.

What to do immediately

1. Disconnect the computer from Wi-Fi and Ethernet. This interrupts further callbacks and limits session or wallet theft while you investigate.
2. Do not restore or allow the detection. Leave the item quarantined unless Microsoft or the verified software vendor confirms a false positive.
3. Save the useful evidence. Photograph or write down the detection name, time, affected item, full path, and visible command-line flags. Do not paste an encoded command into a decoder website because it can contain usernames, device identifiers, or tokens.
4. Update security intelligence. Open Windows Security → Virus & threat protection → Protection updates, then check for updates.
5. Run a Full scan. A Quick scan is not enough when the alert is recurring or a script may have installed persistence.
6. Run Microsoft Defender Offline scan. It restarts Windows and scans before ordinary startup components can hide or relaunch. If it does not restart or produces no result, use our Defender Offline Scan troubleshooting guide.

If the alert keeps coming back

A second-opinion scan is useful here because the visible PowerShell event may be only the launcher. The scan should look for the task, script, original download, later payloads, startup entries, browser changes, and remote-access components—not merely the signed PowerShell executable.

After the scan, review these persistence areas without deleting entries you cannot identify:

• Task Scheduler Library: unfamiliar tasks, especially those that repeat every few minutes or launch PowerShell with hidden or encoded arguments.
• Startup apps and startup folders: items added near the first alert time.
• Installed apps: unfamiliar downloaders, “updates,” browser helpers, game tools, cracks, or remote-access software.
• Browser extensions and notifications: anything installed or allowed just before the incident.
• Services and remote access: new services, SSH configuration, remote desktop changes, or unknown user accounts.

Remove confirmed persistence, reboot, update the scanners again, and repeat the scans. Then reconnect briefly and watch Protection History. A clean result means no new alerts, no re-created tasks or files, and no unexplained outbound connections after normal use.

Protect passwords, sessions, and cryptocurrency wallets

If the suspicious command ran before Defender stopped it, assume browser sessions and credentials may have been exposed. Use a different, known-clean device to:

• change the email password first, then passwords for banking, exchanges, password managers, social accounts, and work services;
• sign out other sessions and revoke browser, application, and API tokens;
• enable multifactor authentication with an authenticator or security key where possible;
• check mail-forwarding rules, recovery addresses, extensions, new devices, and account security logs;
• contact the relevant financial service immediately if you see an unauthorized transaction.

For cryptocurrency, changing an exchange password does not protect a recovery phrase that was viewed or entered on the infected computer. Create a new wallet seed on a clean hardware device and move assets to new addresses. Never reuse the exposed seed.

When to reinstall Windows

A clean Windows installation is the safest recovery when the infection gained administrator access, enabled unknown remote access, modified protected system components, stole wallet recovery words, returns after repeated cleanup, or cannot be fully scoped. Build the installer on a clean computer, back up documents rather than executables or scripts, erase the Windows system partition during setup, and restore only after scanning the backup.

If scans stay clean but you want to verify the system methodically, follow the post-malware Windows security audit. The goal is not simply an empty Protection History screen; it is restored trust in startup, accounts, browsers, and network behavior.

FAQ

References

1. Microsoft Security Intelligence. “Trojan:Win32/Commando.A!ml threat description.” Updated page accessed July 22, 2026. Microsoft threat encyclopedia.
2. Microsoft Learn. “Malware naming.” Updated July 16, 2026; accessed July 22, 2026. Microsoft malware naming guide.
3. Microsoft Learn. “Submit files for analysis.” Accessed July 22, 2026. Microsoft sample submission guide.