BTP Exception not working for ps1 script

L.Shmarya — Sun, 25 May 2025 12:57:53 GMT

Hi Team -

I've created a Legacy Agent Exception Rule to prevent the Behavioral Threat Protection component from blocking a specific (and legitimate) .ps1 file on my network (within a specific user profile), but Cortex keeps blocking the script.

The command line in the alert is:

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "-file" " C:\Temp\ScriptName.ps1 "

The exclusion rule was created as follows:
Platform: Windows
Module: Behavioral Threat Protection

Here are the options I've tried under Target Properties → Files / Folders in allow list:

*ScriptName.ps1
C:\Temp\ScriptName.ps1
powershell.exe-fileScriptName.ps1
-file *ScriptName.ps1

Prevention information:

OS version: 10.0.26100
Component: Behavioral Threat Protection
Status code: c0400067
Prevention description: Behavioral threat detected
Additional information 1: Rule amsi_malicious.b.464633143106

Re: BTP Exception not working for ps1 script

aspatil — Tue, 27 May 2025 09:28:14 GMT

Hello @L.Shmarya ,

For BTP alerts related to powershell you need to reach out to Tech Support and get SUEX from them.

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution". Thank you.

topic BTP Exception not working for ps1 script in Cortex XDR Discussions

BTP Exception not working for ps1 script

Re: BTP Exception not working for ps1 script