Powershell problem

Saul_Najera — Tue, 11 Mar 2025 23:42:20 GMT

Hi forum,

I have a problem with PowerShell, specifically with the file located at C:\Program Files\Winget-AutoUpdate\winget-upgrade.ps1.

When I restart the computer, Cortex send alert appears regarding winget-upgrade.ps1.

I created a disable prevention rule, but it is not working. Here is the information I added:

Files: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Command line: "powershell.exe" -NoProfile -ExecutionPolicy Bypass -File "C:\Program Files\Winget-AutoUpdate\winget-upgrade.ps1"

Can anyone help us with this problem?

Re: Powershell problem

aspatil — Wed, 12 Mar 2025 04:37:34 GMT

Hello @Saul_Najera ,

Please reach out to TAC and get Support Exception. The reason is "Disable prevention rules generate an alert even after allowing the activities where as legacy agent exceptions mostly don't generate alerts and allow a process to run."

However it is not recommended to exclude the behavior. Engineering can help you with the fix.

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution". Thank you.

topic Re: Powershell problem in Cortex XDR Discussions

Powershell problem

Re: Powershell problem