I just received this alert "Script Activity - 245655498" with this description "Suspicious script with keywords written in a non-standard way." in Cor

[N.Patel578121]

I just received this alert "Powershell Activity - 2390140751

" with this description "Suspicious script with keywords written in a non-standard way." in Cortex multiple times related to PowerShell script execution on a developer machine. The executed scripts were different and I don't know why Cortex is blocking such executions. There is also no documentation on this.

[susekar]

Hello @N.Patel578121 ,

Greetings for the day.

The “Powershell Activity - 2390140751” alert is triggered by the BTP rule bioc.suspicious_powershell_obfuscation_backtick, which detects PowerShell scripts using obfuscation or backticks that may be used to bypass security controls.

Resolution:

1. Check Content Updates
   • Make sure the agents are running the latest Content Update.
   • Previous fixes for similar detections were included in CU-1480, CU-1560, and CU-1870.
     
2. Create a Granular Alert Exception
   • Go to Incident Response > Alerts in the Cortex XDR console.
   • Locate the alert and select Manage Alert > Create Alert Exception.
   • Add specific conditions such as Process Path, Command Line, or Signer to ensure the exception only applies to the required developer scripts.

This approach avoids broadly disabling the BTP protection while allowing legitimate PowerShell activity.

Or Create a TAC Support ticket for the latest update on this.

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution".

Thanks & Regards,
S. Subashkar Sekar