: For proper operation, this path must be set in the Environment tab of the PSMConnect and PSMAdminConnect user properties under "Start the following program at logon". Common Issues & Troubleshooting
Temporarily set AppLocker to "Audit Only" to see if the session connects. If it does, you need to re-run the PSMConfigureAppLocker.ps1 script or check if your PSMConnect domain users are correctly defined in the script's configuration. PSMSC036E No Process was found for image - CyberArk
If in doubt, upload the file to . A detection rate of >5 engines suggests malware. psminitsessionexe
title: PsMinISessionExe Unusual Path status: experimental logsource: product: windows category: process_creation detection: selection: Image|endswith: '\psminitsessionexe' filter: Image|contains: '\Program Files\Palo Alto Networks\' condition: selection and not filter
The file is a proprietary executable developed by CyberArk Software Ltd. It is installed on the CyberArk Privileged Session Manager (PSM) server, typically located within the core installation path (e.g., C:\Program Files (x86)\CyberArk\PSM\ ). : For proper operation, this path must be
A: Because PSM acts as a "man-in-the-middle" for sessions, it hooks into system processes and RDP stacks. This behavior resembles remote access trojans (RATs). You must set an exclusion in your antivirus software for the C:\Program Files (x86)\CyberArk\PSM folder.
| Issue | Likely cause | Resolution | |-------|--------------|------------| | High CPU at logon | Session initialization policy scan | Check Cortex XDR policy; exclude large temp folders if safe | | Event ID 7000 (service fail) | Missing dependencies (e.g., PanService) | Reinstall Cortex XDR agent | | Blocks legitimate app after logon | Overly aggressive policy applied by psminitsessionexe | Review policy rules in Cortex XDR console | PSMSC036E No Process was found for image -
If you see connections to (especially over port 4444, 8080, or 1337), investigate immediately.
: Regularly check system resource usage to detect any abnormal behavior by psminitsession.exe or other processes.
The process may consume significant resources, slowing down the computer.
The user's local RDP client opens the file and connects to the CyberArk PSM server.