mwResu Posted March 7 ID:1557768 Share Posted March 7 Hi. I am using ConEmu (https://conemu.github.io/) and get an alert for the PowerShell (Administrator) ?. I don't think this should be. Malwarebytes www.malwarebytes.com -Protokolldetails- Datum des Schutzereignisses: 07.03.23 Uhrzeit des Schutzereignisses: 11:47 Protokolldatei: 75a403ac-bcd5-11ed-a22c-7085c27badc9.json -Softwaredaten- Version: 4.5.23.241 Komponentenversion: 1.0.1927 Version des Aktualisierungspakets: 1.0.66431 Lizenz: Premium -Systemdaten- Betriebssystem: Windows 10 (Build 19045.2673) CPU: x64 Dateisystem: NTFS Benutzer: System -Einzelheiten zu Exploits- Datei: 0 (keine bösartigen Elemente erkannt) Exploit: 1 Exploit.T1055DefenseEvasion, , Blockiert, 0, 392684, 0.0.0, , -Exploit-Daten- Betroffene Anwendung: C:\Program Files\PowerShell\7\pwsh.exe Schutzebene: APT Behavior Protection Schutzverfahren: T1055 - Defense Evasion Dateiname: URL: (end) Link to post Share on other sites More sharing options...
Porthos Posted March 7 ID:1557799 Share Posted March 7 It seems you have enabled some non-default settings in the exploit section of the advanced settings. I suggest you or them restore the defaults in that section. Link to post Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now