topic Re: Exception to prevent the blocking of the Powershell/CMD command in Cortex XDR Discussions

Exception to prevent the blocking of the Powershell/CMD command

Aristooo — Mon, 06 Jan 2025 06:39:48 GMT

Hi. How can I create an exception to prevent specific PowerShell and CMD commands from being blocked by XDR?

Re: Exception to prevent the blocking of the Powershell/CMD command

jmazzeo — Mon, 13 Jan 2025 18:37:40 GMT

Hi @Aristooo, thanks for reaching us using the Live Community.

You can try by creating a Disable Prevention Rule under Configuration - Exceptions Configuration.

You can there enter the command that you need to create the exception, in the "Command line" field. Select the right module by choosing the one that is blocking the process in your case, I have selected BTP for the example which is the common one.

If this post answers your question, please mark it as the solution.

Re: Exception to prevent the blocking of the Powershell/CMD command

Aristooo — Tue, 14 Jan 2025 13:45:51 GMT

Hi @jmazzeo , thanks for your response!

In the CMD Line under Target Properties, can I replace some arguments with *? For example, to capture all arguments in that part of the command. Like replacing "curl https://paloaltonetworks.com --show-error" with "curl https://* --show-error".

Re: Exception to prevent the blocking of the Powershell/CMD command

jmazzeo — Tue, 14 Jan 2025 13:49:12 GMT

Yes, you can use the asterisk as a wildcard.

Re: Exception to prevent the blocking of the Powershell/CMD command

Aristooo — Tue, 14 Jan 2025 13:58:06 GMT

@jmazzeo thank you very much!

Re: Exception to prevent the blocking of the Powershell/CMD command

TurkanAsadova — Fri, 14 Mar 2025 08:56:26 GMT

Hi Cortex XDR Community,

I want to set up an alert in Cortex XDR that triggers whenever any user runs a PowerShell script. The alert should activate for any script or command executed in PowerShell, regardless of the user or specific script.

Is there an existing rule or method to create such an alert for PowerShell usage? Any suggestions or examples would be appreciated.

Thanks in advance!