Share via

Legitimacy and Documentation of PowerShell Script in Windows Defender ATP Data Collection Path

Hitesh Sungar 0 Reputation points
2025-05-01T10:59:20.1733333+00:00

Hi Team,

We’ve observed the following script being executed on several servers:

  1. C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\DataCollection\8795.12576079.0.12576079-309b4e8361ee7020fd7fd8bf26c7c6d27dbe6a99\e42f96b8-39ab-482c-86c3-db42380f8e06.ps1
  2. C:\ProgramData\Microsoft\Windows Defender Advanced Threat Protection\DataCollection\8795.12776012.0.12776012-ea4638610e3d754942a7d3936a46012d82c88e4f\e42f96b8-39ab-482c-86c3-db42380f8e06.ps1

Can anyone please confirm if this is a legitimate Microsoft Defender for Endpoint (ATP) diagnostic or investigation script? Also, is there any official documentation or article that explains its purpose and usage?

We’re considering whitelisting it to reduce false positives but need validation first.

Regards,

Hitesh Sungar

Microsoft Defender for Cloud
Microsoft Defender for Cloud
An Azure service that provides threat protection for workloads running in Azure, on-premises, and in other clouds. Previously known as Azure Security Center and Azure Defender.
1,529 questions
0 comments

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.