Security monitoring has detected the presence of a remote access tool classified as commodity malware on an employee workstation. Does this allow you to discount the possibility that an APT is involved in the attack