It has currently been tested on the following versions: The script is designed to be compatible on all Windows PowerShell versions between 2 and 5. The script will also stop running processes if its executionpath points towards a known indicator of compromise as defined within the script. It checks for the predefined parameters as detailed in the script and nothing more. The script does not proclaim a system as 'safe' or 'secure'. This tool should be used by professionals with the ability to determine both potential impact and outcome of an execution. The hash exclusions in Kaseya's script are not included in this script.The BlackLivesMatter registry key will not be removed as it contains decryption related information.The tool will check for known Indicators of Compromise and when applicable, remove files or stop processes. Execute: Powershell.exe -executionpolicy bypass -file.

Start PowerShell.exe or Cmd.exe as Administrator.We cover details around the attack in our blog post available at: How to Use This tool is intended to be used on end systems running a Kaseya Agent, not on a Kaseya VSA server. Truesec CSIRT team is releasing a script to help victims and responders of the Kaseya ransomware attack to identify and mitigate affected systems.

Kaseya agent download