After a recent Windows update, two PowerShell processes started appearing in the background. One stays open continuously, while the other launches and exits about once per second. Windows Defender found nothing, and Malwarebytes only reported heuristic detections related to a programming language and its package manager, which appear to be false positives.
Event Viewer shows repeated PowerShell events with IDs 600, 400, and 800, covering provider lifecycle, engine lifecycle, and pipeline execution. The command being run uses PowerShell with -NoProfile and -NonInteractive, dynamically compiles a small C# snippet through Add-Type, and calls SHQueryUserNotificationState from shell32.dll to check the Windows notification state.
Process Monitor shows the activity touching many Microsoft components as well as installed applications. I also noticed csc.exe, the .NET C# compiler, repeatedly running with temporary command-line files under my user Temp directory. Is this normal Windows or application behavior, or could it indicate malware? What is the best way to identify which program is launching these PowerShell processes?
2 Answers
The command itself is checking whether Windows is currently in a state where user notifications can interrupt you. That explains why it touches various installed applications; it is likely checking notification-related state rather than scanning those programs.
The important part is finding the parent process. Run this while the PowerShell processes are present:
Get-CimInstance Win32_Process | Where-Object Name -eq 'powershell.exe' | Select-Object ProcessId,ParentProcessId,CommandLine
Then inspect the parent PID:
Get-Process -Id
If the parent is a familiar application, it may simply be poorly designed software. If it is an unknown executable running from a temporary or user-profile directory, investigate it more carefully.
You can also inspect the temporary command file passed to csc.exe, such as the file under AppDataLocalTemp referenced by the @"...cmdline" argument. However, these files may be deleted and recreated very quickly, so the parent-process check is usually more useful for finding the application responsible.
The temporary file was being replaced too quickly to inspect reliably. Identifying the parent process worked, and confirmed that the application was responsible.
That identified the cause. The parent process was Edge-Drop, a clipboard-history application I had recently installed to replace Ditto. It was launching the PowerShell notification check repeatedly, so this turned out to be a badly behaved application rather than malware.