Alert for Any PowerShell Script Execution in Cortex XDR

[TurkanAsadova]

Hi Cortex XDR Community,

I want to set up an alert in Cortex XDR that triggers whenever any user runs a PowerShell script. The alert should activate for any script or command executed in PowerShell, regardless of the user or specific script.

Is there an existing rule or method to create such an alert for PowerShell usage? Any suggestions or examples would be appreciated.

Thanks in advance!

[tlmarques]

Hi think we can use BTP.

I need something link that, because today many malicious groups are using ""powershell -exec bypass -enc <base64 encrypted command string>

"" for bypass security, and i dont know if Cortex XDR   block that or alert the executions.

[tlmarques]

i try run a simple script with base64 (not malicious) and XDR detect:

'PowerShell runs suspicious base64-encoded commands' along with 1 other alert generated by XDR Analytics BIOC detected on host lsXXXX involving user hXXXXX