TrojanDownloader:PowerShell/Falsip.A is a Microsoft Windows Defender detection for PowerShell scripts that download other malware onto a computer. These scripts may be distributed as spam ...

Is execution of powershell scripts enabled in AD? I think it's off by default. Also, is the script signed? I believe the default doesn't allow unsigned scripts to run.