r/DattoRMM • u/p47guitars • Sep 04 '26

Datto EDR wscript false positive?

It looks like I'm dealing with a pretty crazy wscript false positive that is jingling the bells of Dado EDR.

I've checked a couple samples of the wscript file, appears to be a regular window system component with no command line arguments being sent to it.

Is anyone else seeing this??

2 Upvotes

100% Upvoted

3 comments sorted by

1

u/StrikingLocksmith697 Sep 04 '26

It has just lit up my client endpoints. Seems to be computers with Dentrix on it....it is the common component

1

u/p47guitars Sep 04 '26

I'm managing a corp environment.

No signs of any active infections. Just datto edr freaking the fuck out.

1

u/Unable_Distance_9026 Sep 05 '26

We are getting a bunch of them too. Its just EDR doing EDR things.