PowerShell Script Files when enabled showing as Risk

A.Alharbi095930 — Sun, 09 Feb 2025 10:01:07 GMT

Hi ,

when enabling the PowerShell Script Files in the Malware profile , after the save it's showing as Risk with this profile!

can some explained the why ? and was it useful to enable PowerShell Script Files in the Malware profile ?

thank you.

Re: PowerShell Script Files when enabled showing as Risk

nsinghvirk — Mon, 10 Feb 2025 15:17:41 GMT

Hello @A.Alharbi095930

Thanks for reaching out on LiveCommunity!

Starting from release of XDR version 3.12, AI-powered powershell script file examination has been introduced. Since AI models require lot of data to learn and improve their findings hence the "At risk" banner is shown as a warning to test this feature on a small number of endpoints before going into full scale production environment. In this way you can avoid lot of false positive alerts and prevent accidental blocking of legitimate powershell scripts.

Please click Accept as Solution to acknowledge that the answer to your question has been provided.

topic Re: PowerShell Script Files when enabled showing as Risk in Cortex XDR Discussions

PowerShell Script Files when enabled showing as Risk

Re: PowerShell Script Files when enabled showing as Risk