Why does Powershell V1 (and not V7) trying to access %system%\CatRoot?

[Adriano Castaldini]

Hi, everyone. Defender notificates that Powershell.exe is trying to access %system%\CatRoot. It should be regular BUT the fact that the specific Powershell is NOT the updated pwsh.exe (version 7) I've installed recently, but the old (and potentially unsafe) version 1.It's strange because when I installed Powershell7, I checked the specific option "Add Run with Powershell7 context menu for Powershell files".I asked to a nice technical-support operator that said: "The Powershell version that is trying to access to %system%\CatRoot is likely determined by the script or process that is invoking it

Continue reading...