cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
enxl
Level 8
Report Inappropriate Content
Message 1 of 15

EPO 5.10 Update 10 Unsigned powershell

Hello,

We were able to upgrade to EPO 5.10 Update 10 last week. Ever since we ran the upgrade I have been getting alerts from EPO about our EPO trying to run unsigned powershell scripts. Not only is it trying to run unsigned scripts it's trying to bypass our GPO policy that is set to not allow it to run unsigned scripts.

Pipeline execution details for command line: .

Context Information:
DetailSequence=1
DetailTotal=1

SequenceNumber=74

UserId=domainnotdomain\SYSTEM
HostName=ConsoleHost
HostVersion=5.1.14409.1018
HostId=40e03b0b-8e97-4543-9895-aa249243e477
HostApplication=powershell.exe -ExecutionPolicy Bypass -NoExit -NoProfile -Command -
EngineVersion=5.1.14409.1018
RunspaceId=8e8d6555-e956-4743-836c-b220f8941b02
PipelineId=3
ScriptName=
CommandLine=

Details:
CommandInvocation(Out-Default): "Out-Default"
ParameterBinding(Out-Default): name="InputObject"; value="File C:\ProgramData\McAfee\psscript_16182468120774056803211595919372.ps1 cannot be loaded. The file C:\ProgramData\McAfee\psscript_16182468120774056803211595919372.ps1 is not digitally signed. You cannot run this script on the current system. For more information about running scripts and setting execution policy, see about_Execution_Policies at http://go.microsoft.com/fwlink/?LinkID=135170."

Why would a security company include unsigned powershell as part of an update to it's products and what exactly is this powershell supposed to be doing? 

14 Replies
vivs
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 2 of 15

Re: EPO 5.10 Update 10 Unsigned powershell

Hello @enxl 

Thanks for your post.

I would like to request you to please open a Service Request with Support.

Was my reply helpful?
If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?

ChrisQ
Reliable Contributor
Reliable Contributor
Report Inappropriate Content
Message 3 of 15

Re: EPO 5.10 Update 10 Unsigned powershell

Is this expected? I was going to attempt the upgrade tomorrow, but am unsure I should do so if it's going to run unsigned powershell scripts.

vivs
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 4 of 15

Re: EPO 5.10 Update 10 Unsigned powershell

Hello @ChrisQ 

Thanks for your query.

We have not seen such issues with ePO CU updates.

As recommended to @enxl  please open a Service Request to get it investigated.

Was my reply helpful?
If this information was helpful in any way or answered your question, will you please select Accept as Solution in my reply and together we can help other members?

enxl
Level 8
Report Inappropriate Content
Message 5 of 15

Re: EPO 5.10 Update 10 Unsigned powershell

It's really quite scary that you are unaware that every hour EPO 5.10 update 10 is trying to run an unsigned powershell script.

 

JoeBidgood
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 6 of 15

Re: EPO 5.10 Update 10 Unsigned powershell

Apologies for coming late to the thread. I believe the cause of this is the Support Centre extension, which uses powershell scripts for a number of the checks it runs. (I think the main one is the server CPU check.)

This has been asked by other customers, and the engineering team have provided the attached statement, which should hopefully address the concern.

Regards -

Joe

enxl
Level 8
Report Inappropriate Content
Message 7 of 15

Re: EPO 5.10 Update 10 Unsigned powershell

Okay so even if it does use powershell, that doesn't explain why the script is not signed in Update 10 and it apparently was signed in the previous version and it also doesn't explain why EPO is flagging the powershell as being malicious.

JoeBidgood
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 8 of 15

Re: EPO 5.10 Update 10 Unsigned powershell

Hm, as far as I know this functionality hasn't changed since the support centre extension was released. 

What is actually reporting this? ePO itself doesn't detect things like this, so is it maybe something like ENS on the ePO server that's generating the detection? I'll see if I can reproduce the results.

Regards -

Joe

enxl
Level 8
Report Inappropriate Content
Message 9 of 15

Re: EPO 5.10 Update 10 Unsigned powershell

Threat prevention is sending an alert to EPO every hour.

ExP:Illegal API Use was detected as an attempt to exploit C:\WINDOWS\SYSTEM32\WINDOWSPOWERSHELL\V1.0\POWERSHELL.EXE, which targeted the AtlComPtrAssign API. Which happens with a lot of software as everyone knows, but it didn't start happening until 4/9/2021 when we upgraded.

The corresponding message in the PowerShell Windows event log is what I posted.

JoeBidgood
McAfee Employee
McAfee Employee
Report Inappropriate Content
Message 10 of 15

Re: EPO 5.10 Update 10 Unsigned powershell

OK, thanks. What CU did you have applied before you went to CU10? The support centre extension has had a number of versions so I want to make sure I'm testing the correct version.

Thanks -

Joe

You Deserve an Award
Don't forget, when your helpful posts earn a kudos or get accepted as a solution you can unlock perks and badges. Those aren't the only badges, either. How many can you collect? Click here to learn more.

Community Help Hub

    New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

  • Find Forum FAQs
  • Learn How to Earn Badges
  • Ask for Help
Go to Community Help

Join the Community

    Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

  • Get helpful solutions from McAfee experts.
  • Stay connected to product conversations that matter to you.
  • Participate in product groups led by McAfee employees.
Join the Community
Join the Community