Microsoft Defender for Endpoint - too many *.ps1 scripts in C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\DataCollection

Question

Hi there,

I have several identical laptops that are used the same, but on several of them Microsoft Defender for endpoint runs .ps1 scripts in the folder C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\DataCollection. Because there are dozens of these scripts, Microsoft Sentinel constantly generates Incidents based on the Process execution frequency anomaly rule. But nothing like this happens on other laptops. I can't find out what the content of these scripts is and how I should proceed to eliminate this behavior. Please, advice. Thanks, Jan.

Answer 1

I'm seeing the same issue with Carbon Black cloud alerting on these also.

Answer 2

I am also interested in this answer. P

Answer 3

I have a feeling that this is caused by the endpoint sensor (Intune > Endpoint security | Endpoint detection and response)

Answer 4

Interested to know the answer.