CISA names precursor malware infections as one of six ways into a ransomware incident, and lists QakBot, Bumblebee and Emotet as common examples. So when endpoint tools catch a loader or dropper, the right question is not only "is it removed?" but "what else did it let in?"
What a precursor is
A precursor is malware whose job is to get a foothold and then hand it on. The guide's Part 2 names Bumblebee, Dridex, Emotet, QakBot and Anchor as examples of dropper malware to look for. CISA also warns that attackers often drop ransomware to hide earlier activity, and that rebuilding systems without finding the dropper can allow continued compromise.
Why cleanup alone is not enough
If a machine is reimaged and the ticket closed, three things may be left behind:
- Stolen credentials from that machine, which still work.
- Remote access tools or accounts the operator added.
- A foothold on other systems reached by lateral movement.
A response routine for precursor alerts
- Isolate the host and preserve evidence before reimaging.
- Reset credentials used on that machine, including service accounts.
- Search for the same indicators across the estate.
- Check for later stage activity, using the signs in CISA's checklist: new privileged accounts, unexpected remote management tools, credential dumping and backup tampering.
- Look at email and phishing origin for the initial delivery path, then fix it.
- Decide whether to escalate to a full incident. If any later stage sign appears, do.
Detection quality
Your tooling should surface loader detections as high priority. CISA's guide says to examine existing antivirus, EDR, IDS and IPS records and logs for evidence of earlier stage malware. If those logs are only kept for days, you may not be able to answer the question later. CISA suggests retaining logs for at least a year where possible.
Communicate it plainly
Tell the help desk and the endpoint team that a precursor detection is a security incident, not a device problem. Many teams treat them as routine and lose the early window.
Common mistakes
- Closing the ticket as soon as the endpoint tool says removed.
- Reimaging before capturing evidence.
- Resetting only the user's password and not the service accounts on the host.
- Leaving out the email team, who can find the delivery path.
Quick check
Is a blocked phishing attachment a precursor incident?
Not if it never ran. A precursor incident is one where the malware executed. Check whether anyone opened it before assuming either way.
Should we reimage immediately?
Capture what you need first. Reimaging erases the evidence that shows what the infection did.
Sources
Last reviewed: 19 October 2026.
