Detected presence of malicious files through file reputation or third-party scanners. (x1)

Detected presence of malicious files through analyst-vetted file reputation. (x3)

Detected presence of known software supply chain attack artifacts. (x3)

Detected presence of software components that can access user identity information. (x1)