How to Powershell malicious check

Samuel-Setiawan — Tue, 10 Oct 2023 02:20:15 GMT

Hi, im need to Powershell malicious check i Cortex XDR with Instance Administrator console role, how can i do?

Re: How to Powershell malicious check

aspatil — Tue, 10 Oct 2023 05:57:13 GMT

Hello Samuel,

Thank you for writing to live community!

The Cortex XDR Agent features Behavioral Threat Protection modules leverages the Anti-Malware Scan Interface (AMSI) to block PowerShell scripts.

To create a BIOC rule, please check out Live Community How-to video Script Block Query and BIOC | Palo Alto Networks

Hope this helps!

Please mark the response as "Accept as Solution" if it answers your query.

Regards.