However, malware authors sometimes name their payloads after legitimate processes. Several known malware families have used variations like psminitsession.exe , psm session.exe , or psminit.exe to hide in plain sight.

Only remove or disable psminitsessionexe if you are certain Puppet is no longer needed. Uninstalling the process incorrectly can break existing automation.

Because it is the "gateway" for every connection, issues with this executable are common troubleshooting points for CyberArk Administrators [27].