365 Defender 'SuspiciousScriptDrop' malware was prevented alerts, False positive?

Question

Hi all,
for two days perhaps coincidentally since the security updates were released via SCCM,
the following alarms alerts are continuously generated on Windows Server 2019 servers by Microsoft 365 Defender:
'SuspiciousScriptDrop' malware was prevented
'SuspiciousScriptDrop' malware was prevented on a Microsoft SQL server
'SuspiciousScriptDrop' malware was prevented on an IIS Web server
the event seems to be generated by the execution of a powershell script which always changes the final part of the name:
_PSScriptPolicyTest_e5xewz2b.d1e.ps1
__PSScriptPolicyTest_hfszzy13.twt.ps1
__PSScriptPolicyTest_mvd5cukz.i50.ps1
__PSScriptPolicyTest_buadpcch.hak.ps1
the malware detected is the following (VirusTotal detection ratio 0/0):
Trojan:JS/SuspiciousScriptDrop.B!pwsh
the file path is always:
C:\Windows\Temp\
the usser is always the LocalSystem user:
NT AUTHORITY\SYSTEM
command line:
powershell.exe -NoLogo -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -File Maintenance.ps1

Why are these alarms generated? Do we have to go deep into their analysis or are they false positives?

Answer 1

Do we have to go deep into their analysis or are they false positives?

they are false-positive. These scripts are automatically generated and dropped to Temp folder (system or user, depending on a running user account) by PowerShell itself. Since version 5.1, PowerShell actively enforces constrained (restrictive) language mode depending on SRP/Applocker enforcement. When you start the PowerShell, a temporary script is generated and attempted to execute. If file is blocked, PowerShell starts in constrained language mode which greatly limits the functionality of the PS engine. If file is not blocked, PowerShell starts in unrestricted language mode. Here are more details from official PowerShell Team blog: https://devblogs.microsoft.com/powershell/powershell-the-blue-team/#constrained-powershell

you can completely ignore these that contain "PSScriptPolicyTest" alerts.

Answer 2

Try submit the script to the Microsoft Anti-Malware portal, take a look at:
https://www.microsoft.com/en-us/wdsi/filesubmission
And see if it being detected as malware too?
If not you may submit a ticket to the Microsoft Defender 365 team.

Answer 3

@Vadims Podāns thank you for your answer.
I thought it was a false positive, but I wanted the confirmation, also because it seems strange to me the alarm was generated only on 4 servers out of 200.
Thank you,
Alfio