Adding batch and Powershell scripts to XDR blocklist

VarunPitale — Mon, 07 Apr 2025 08:52:31 GMT

Considering PE, PE64 and macro enabled Word and Excel documents are allowed to be entered to blocklist, does it make any sense to add a .bat or a powershell PS1 file to the XDR blocklist Cortex XDR

Re: Adding batch and Powershell scripts to XDR blocklist

Chamindu — Tue, 08 Apr 2025 05:41:41 GMT

Honestly, adding a.bator .ps1 file to the XDR blocklist can work, but only in very specific cases. you are basically telling XDR, “Hey, if you see this exact file (by its hash), block it.” That’s cool if you’re dealing with a known, unchanging script but let’s be real, attackers don’t usually play that way. scripts change, get obfuscated, renamed, or generated on the fly.

So, does it make sense? Yes. but only if you are targeting a very specific threat and you’ve got the exact hash.

But for broader protection? Not really ideal.

If your goal is to stop .bat or PowerShell scripts from running altogether (especially in places they shouldn’t be), you’re better off using a Restrictions Security Profile. That lets you say, “Don’t allow any scripts from these folders,” or “Block scripts entirely.” It’s way more flexible and doesn’t rely on the file being identical every time.

topic Adding batch and Powershell scripts to XDR blocklist in Cortex XDR Discussions

Adding batch and Powershell scripts to XDR blocklist

Re: Adding batch and Powershell scripts to XDR blocklist