I have a problem that psscriptpad is flaged as malicious by SentinelOne
I have runned it through virustotal and this is the result.
What should we do?
Tool: Visual Studio, Visual Studio Code, PSScriptPad, PowerShell Module
Version:
Hi @joakim.sandin, thanks for posting about this. Based on my checking, the only immediate option is to contact your administrator with the details and ask them to add an exception per Microsoft link below.
Handle false positives in Microsoft Sentinel | Microsoft Learn
More
Despite the file having a valid signed certificate, some security vendors are particularly sensitive as evidenced by the low hit rate of 8/71 vendors (11% hit rate). SentinelOne does not appear to have any public facing to allow users to upload their files for investigation directly. Thus, the only immediate relief in this case is with your administrator.
In the meantime, I have raised a feature request on the github tracker at PSScriptPad external communications should be off by default · Issue #2597 · ironmansoftware/issues (github.com) for Adam’s consideration.
Are there any options on your side to work with your administrator? If that person were to review the virustotal report it should be evident that the file is not malicious.
1 Like