False Positive: Suspicious File Modification' generated by XDR Agent - Module Anti-Ransomware Protection

[Rindsland]

Hi we see a problem with a powershell Script we are using to clean up Profiles on some specific Remote Session Host Servers.

It will be blocked by Cortex XDR Pro and so I want to make an Exception for this.

Unfortunately it seems only possible to do an Alert Exception for this and so it will allow the Initiator CGO "Powershell.exe"

for the Ransomware Module in General, which seems to be a bit to dangerous for me.

I didn't found anything to allow just the Powershell Script + Path + Systemname (for example) instead of powershell.exe.

You can edit very granular Exclusions but it seems to be not possible to do the same for exceptions, or?

Is there maybe something other, I can do, to allow the Script without giving any powershell script free to run?

Kind Regards

Marcus

[bbarmanroy]

Hey @eumbach , you'll need to perform the action under PE and DLL examination (step 3c) and see if that meets your requirements.

[eumbach]

That's a directory not a CGO.