PSWindowsUpdate icon indicating copy to clipboard operation
PSWindowsUpdate copied to clipboard

Security issue - Why is pswindowsupdate.dll process consistently running in background?

Open sniperdoc opened this issue 1 year ago • 3 comments

It appears to be periodically running. I thought this was a manual tool for sysadmins to use? Not something to runs periodically in the background.

Policy Matched: Default - Servers Organization Name: xxxxxxx Hostname: xxxxxxxx Username: xxxxxxxxxx Full Path: c:\program files\windowspowershell\modules\pswindowsupdate\2.2.1.5\pswindowsupdate.dll Process Path: c:\windows\system32\windowspowershell\v1.0\powershell.exe Created By Process: ["c:\windows\system32\windowspowershell\v1.0\powershell.exe"] Hash: E5E1F9C5C90835B4781BCA3C885A929A SHA256Hash: A82AD86FB4C59748F474151BCA43EADABA86A64DF252DED768FCF6219E2B8A6A Certificate: cn=powerclouds michal gajda, o=powerclouds michal gajda, l=warszawa, c=pl Action Type: execute Effective Action: Denied

sniperdoc avatar Nov 19 '24 20:11 sniperdoc