For the past few days, I have received this message from Bitdefender. How can I resolve this. Thanks
This was the message:
Potentially malicious application blocked
an hour ago
Feature: Advanced Threat Defense
Application powershell.exe has been detected as potentially malicious and was blocked.
Application path: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Command line parameters: "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy
Restricted -Command
$isBroken = 0
# Define the root registry path
$ShellRegRoot = 'HKCU:\Software\Classes\Local
Settings\Software\Microsoft\Windows\Shell'
$bagMRURoot = $ShellRegRoot + '\BagMRU'
$bagRoot = $ShellRegRoot + '\Bags'
# Define the target GUID tail for MSGraphHome
$HomeFolderGuid = '14001F400E3174F8B7B6DC47BC84B9E6B38F59030000'
$properties = Get-ItemProperty -Path $bagMRURoot
foreach ($property in $properties.PSObject.Properties) {
if ($property.TypeNameOfValue -eq 'System.Byte[]') {
$hexString = ($property.Value | ForEach-Object { $_.ToString('X2') }) -join ''
if ($hexString -eq $HomeFolderGuid) {
$subkey = $property.Name
$nodeSlot = Get-ItemPropertyValue -Path ($bagMRURoot + '\' + $subkey) -Name 'NodeSlot'
$isBroken = if ((Get-ItemPropertyValue -Path ($bagRoot + '\' + $nodeSlot + '\Shell\*') -Name 'GroupView') -eq 0) { 1 } else { 0 }
break
}
}
}
Write-Host 'Final result:',$isBroken
Detection ID: SuspiciousBehavior.21EF5C781F145B56
