Unknown script policy warnings

SaintKev2
SaintKev2
in WatchGuard EPDR/EDR/EPP

Hi, I am having an issue with threat intelligence platform email warnings.

I am getting hundreds of emails a day for _PSScriptPolicyTest_XXXXXXX.ps1 files
the problem is the XXXXXXX part is a randon file name each time.

These are all false positives, I have been told I have to add them as a file exclusion, but how can I do that when each time its a random file name?

Is anyone else getting these notifications and how have you handled them?

Many thanks

Comments

  • David_Carro
    David_Carro WatchGuard Representative

    Hello, @SaintKev2
    As this is a private policy and a security matter, I suggest you open a case to support, so we can provide the answer to it, which we do have, of course.

    Regards,

    David Carro | Technical support
    WatchGuard Technologies, Inc. | www.watchguard.com

  • SaintKev2
    SaintKev2

    unfortunately I am unable to log support cases with you directly and will need to go through our VAR. I will reach out to them.

  • David_Carro
    David_Carro WatchGuard Representative
    edited April 10

    I am going PM

    David Carro | Technical support
    WatchGuard Technologies, Inc. | www.watchguard.com

  • SkyJaxx
    SkyJaxx

    This is not a private policy issue, rather a Microsoft test script that is built into the system.

    • These files are related to routine checks Microsoft implemented to determine which Language Mode to use for PowerShell.

    I'm getting many of these as well. What is the best way to allow these false positives?

  • David_Carro
    David_Carro WatchGuard Representative

    The best approach would be to open a support case so that our laboratory can analyze the issue from its core and evaluate the possibility of excluding those scripts by using a distinctive identifier that classifies them as legitimate (goodware) scripts

    David Carro | Technical support
    WatchGuard Technologies, Inc. | www.watchguard.com

Categories