topic Re: Exclude Powershell Scripts in Endpoint

Exclude Powershell Scripts

tom_allen — Wed, 12 Feb 2020 20:32:56 GMT

I have a need to for a couple of users to be able to run some PowerShell scripts on their PC's. Currently they are getting flagged and the script put in quarantined. Its being flagged as PDM:Trojan.Win32.Generic with the category of riskware. How do I go about setting this up? Thanks!

Re: Exclude Powershell Scripts

PhoneBoy — Wed, 12 Feb 2020 20:52:51 GMT

I assume this is an Endpoint AV question.
I don’t think we flag ALL Powershell scripts, or is that what’s happening?
Might be worth a TAC case as it could be a false positive.

Re: Exclude Powershell Scripts

J_B — Thu, 13 Feb 2020 10:52:41 GMT

Could configure the scripts to be excluded from being scanned in the Anti-Malware policy on the management server?

Re: Exclude Powershell Scripts

Michi — Tue, 05 Oct 2021 11:23:27 GMT

Is there an answer to this situation?

BR Michele

Re: Exclude Powershell Scripts

Swordfish — Tue, 05 Oct 2021 12:30:17 GMT

If the script gets blocked by the Anti-Malware Blade, this SK helps: sk162553

If some of the SBA blades are involved: sk128472

If you want to disable the complete protection itself (I do not recommend it, due to a potential security risk): sk162072