topic Alert for Any PowerShell Script Execution in Cortex XDR in Cortex XDR Discussions

Alert for Any PowerShell Script Execution in Cortex XDR

TurkanAsadova — Fri, 14 Mar 2025 09:22:23 GMT

Hi Cortex XDR Community,

I want to set up an alert in Cortex XDR that triggers whenever any user runs a PowerShell script. The alert should activate for any script or command executed in PowerShell, regardless of the user or specific script.

Is there an existing rule or method to create such an alert for PowerShell usage? Any suggestions or examples would be appreciated.

Thanks in advance!

Re: Alert for Any PowerShell Script Execution in Cortex XDR

tlmarques — Fri, 14 Mar 2025 12:06:55 GMT

Hi think we can use BTP.

I need something link that, because today many malicious groups are using ""powershell -exec bypass -enc <base64 encrypted command string>

"" for bypass security, and i dont know if block that or alert the executions.

Re: Alert for Any PowerShell Script Execution in Cortex XDR

tlmarques — Fri, 14 Mar 2025 12:13:46 GMT

i try run a simple script with base64 (not malicious) and XDR detect:

'PowerShell runs suspicious base64-encoded commands' along with 1 other alert generated by XDR Analytics BIOC detected on host lsXXXX involving user hXXXXX