PSScriptPad.exe is detected as a Trojan and removed by Cisco Secure Endpoint

[dyermull]

I’m trying to evaluate PowerShell Pro Software for Visual Studio Code. Most of the extension seems to install, but during the installation CSE flags PSScriptPad.exe as a Trojan and quarantines the file. I’m in the process of getting IT security to safelist it, but I’m already 2 days in and am concerned I won’t get this approved before my 14 day trial period is up.

Has anyone else seen this? Any advice?

Cisco Secure Endpoint
Detection Name:
Trojan.GenericKD.68490069

Thanks!

[insomniacc]

The same thing was raised in a recent thread with sentinel:

PSScriptpad flagged as malicious

Hi @joakim.sandin, thanks for posting about this. Based on my checking, the only immediate option is to contact your administrator with the details and ask them to add an exception per Microsoft link below. Handle false positives in Microsoft Sentinel | Microsoft Learn More Despite the file having a valid signed certificate, some security vendors are particularly sensitive as evidenced by the low hit rate of 8/71 vendors (11% hit rate). SentinelOne does not appear to have any public facing to…

Hope that helps, I’m sure that someone from the team can help with your trial license too for any days missed out on.

[BakersDozen]

Regarding the false positive detections from CSE, please have your administrator look into setting an exception within your CSE environment (see here) for PSScriptPad.exe.

As @insomniacc mentioned, you can reach out to our Ironman Software Support Team at Product Support - Ironman Software. Once a ticket is created, we can assist with any questions or concerns you may have including an extension of a trail license.

[dyermull]

Thank you for the info. I’ll work with our security team on getting an exception.