Troubleshooting DAC Unknown file is contained.

[Glenn_Bolton]

I have been seeing some strange Threat Event entries for a particular server. My ENS 10.7 DAC settings are default (Trigger Dynamic Application Containment when reputation threshold reaches:
Might be Malicious) and no rule name is referenced. I am puzzled as to why the file is being contained by DAC. Is there any additional troubleshooting options that I can utilize?

The message is: Description: Adaptive Threat Protection ran the Microsoft.PowerShell.Commands.Utility.ni.dll application in a container because its reputation (Unknown) is below the configured containment threshold.

Threat Name: ATP/Suspect!fba6935314a0
Threat Type: Dynamic Application Containment
Source File Path: C:\Windows\System32\WindowsPowerShell\v1.0
Target Name: Microsoft.PowerShell.Security.ni.dll
Threat Source Process Name: powershell.exe
Threat Target Process Name: Microsoft.PowerShell.Commands.Utility.ni.dll

Thank you.

[Tares1 · Accepted solution]

Hello @Former Member

Thank you for reaching the support community.

If the issue is reproducible I recommend enabling debug logging on ENS ATP and opening a support case for analysis of the event.