topic Re: Cortex XDR to block specific powershell script in Cortex XDR Discussions

Cortex XDR to block specific powershell script

elzahy — Thu, 03 Jul 2025 06:37:54 GMT

Hello Team,

I have a script that I would like to block across the entire estate.
Is there a way to achieve this in Cortex?

Thank you.

Re: Cortex XDR to block specific powershell script

tlmarques — Thu, 03 Jul 2025 10:52:20 GMT

hi,
You can try add the hash script on action center- block list and add the same hash on IOC tab.

Re: Cortex XDR to block specific powershell script

elzahy — Fri, 04 Jul 2025 07:17:13 GMT

Hi Tiago,

Thank you for your response. Blocking the hash is one option, but we are also concerned that the user might rename the script, resulting in a different hash value. Is there any way to block a specific command instead?

Thank you.