EPO 5.10 Update 10 Unsigned powershell

[enxl]

Hello,

We were able to upgrade to EPO 5.10 Update 10 last week. Ever since we ran the upgrade I have been getting alerts from EPO about our EPO trying to run unsigned powershell scripts. Not only is it trying to run unsigned scripts it's trying to bypass our GPO policy that is set to not allow it to run unsigned scripts.

Pipeline execution details for command line: .

Context Information:
DetailSequence=1
DetailTotal=1

SequenceNumber=74

UserId=domainnotdomain\SYSTEM
HostName=ConsoleHost
HostVersion=5.1.14409.1018
HostId=40e03b0b-8e97-4543-9895-aa249243e477
HostApplication=powershell.exe -ExecutionPolicy Bypass -NoExit -NoProfile -Command -
EngineVersion=5.1.14409.1018
RunspaceId=8e8d6555-e956-4743-836c-b220f8941b02
PipelineId=3
ScriptName=
CommandLine=

Details:
CommandInvocation(Out-Default): "Out-Default"
ParameterBinding(Out-Default): name="InputObject"; value="File C:\ProgramData\McAfee\psscript_16182468120774056803211595919372.ps1 cannot be loaded. The file C:\ProgramData\McAfee\psscript_16182468120774056803211595919372.ps1 is not digitally signed. You cannot run this script on the current system. For more information about running scripts and setting execution policy, see about_Execution_Policies at http://go.microsoft.com/fwlink/?LinkID=135170."

Why would a security company include unsigned powershell as part of an update to it's products and what exactly is this powershell supposed to be doing? 

[Former Member]

Hello @enxl 

Thanks for your post.

I would like to request you to please open a Service Request with Support.

Was my reply helpful?
If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?

[ChrisQ]

Is this expected? I was going to attempt the upgrade tomorrow, but am unsure I should do so if it's going to run unsigned powershell scripts.

[Former Member]

Hello @ChrisQ 

Thanks for your query.

We have not seen such issues with ePO CU updates.

As recommended to @enxl  please open a Service Request to get it investigated.

Was my reply helpful?
If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?

[enxl]

It's really quite scary that you are unaware that every hour EPO 5.10 update 10 is trying to run an unsigned powershell script.

[JoeBidgood]

Apologies for coming late to the thread. I believe the cause of this is the Support Centre extension, which uses powershell scripts for a number of the checks it runs. (I think the main one is the server CPU check.)

This has been asked by other customers, and the engineering team have provided the attached statement, which should hopefully address the concern.

Regards -

Joe

[enxl]

Okay so even if it does use powershell, that doesn't explain why the script is not signed in Update 10 and it apparently was signed in the previous version and it also doesn't explain why EPO is flagging the powershell as being malicious.

[JoeBidgood]

Hm, as far as I know this functionality hasn't changed since the support centre extension was released. 

What is actually reporting this? ePO itself doesn't detect things like this, so is it maybe something like ENS on the ePO server that's generating the detection? I'll see if I can reproduce the results.

Regards -

Joe

[enxl]

Threat prevention is sending an alert to EPO every hour.

ExP:Illegal API Use was detected as an attempt to exploit C:\WINDOWS\SYSTEM32\WINDOWSPOWERSHELL\V1.0\POWERSHELL.EXE, which targeted the AtlComPtrAssign API. Which happens with a lot of software as everyone knows, but it didn't start happening until 4/9/2021 when we upgraded.

The corresponding message in the PowerShell Windows event log is what I posted.

[JoeBidgood]

OK, thanks. What CU did you have applied before you went to CU10? The support centre extension has had a number of versions so I want to make sure I'm testing the correct version.

Thanks -

Joe