Powershell exploit

SiSma

From this morning on about 90 clients i have this issue:
WatchGuard EPDR has detected the activity of an exploit that compromised the following program: "SYSTEM|\WindowsPowerShell\v1.0\powershell.exe",
Path of the compromised program: SYSTEM|\WindowsPowerShell\v1.0\powershell.exe
Hash of the compromised program: 2E5A8590CF6848968FC23DE3FA1E25F1

False positive or what? Any ideas?

Patrice_LT

Hi,

Same problem here on 80 computers.

Any news ?

Regards,

Patrice

Patrice_LT

The exploit reported is "Exploit/NetReflectiveLoader" on powershell.exe

Patrice_LT

@SiSma : are you using intune or Microsoft Defender ?

SiSma

@Patrice_LT said:
@SiSma : are you using intune or Microsoft Defender ?

Yes Defender...you too?

David_Carro

The solution to the antiexploit detection to the Defender file has already been deployed.
They should stop giving this message as soon as they get the update.

Sorry for the inconvenience.

Rakesh_Mishra

Same Problem with our users also , any idea to resolve

David_Carro

Hello, @Rakesh_Mishra

The solution to the anti exploit detection to the Defender file has already been deployed last Thursday the 28th
Probably this device has just been started today, since last Thursday.
Let it update, the detection will stop.