BTP Exception not working for ps1 script

[L.Shmarya]

Hi Team - 

I've created a Legacy Agent Exception Rule to prevent the Behavioral Threat Protection component from blocking a specific (and legitimate) .ps1 file on my network (within a specific user profile), but Cortex keeps blocking the script.

The command line in the alert is:

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "-file" " C:\Temp\ScriptName.ps1 "

The exclusion rule was created as follows:
Platform: Windows
Module: Behavioral Threat Protection

Here are the options I've tried under Target Properties → Files / Folders in allow list:

• *ScriptName.ps1
• C:\Temp\ScriptName.ps1
• powershell.exe-fileScriptName.ps1
• -file *ScriptName.ps1

Prevention information:

• OS version: 10.0.26100
• Component: Behavioral Threat Protection
• Status code: c0400067
• Prevention description: Behavioral threat detected
• Additional information 1: Rule amsi_malicious.b.464633143106

[aspatil]

Hello @L.Shmarya ,

For BTP alerts related to powershell you need to reach out to Tech Support and get SUEX from them.

If you feel this has answered your query, please let us know by clicking like and  on "mark this as a Solution". Thank you.