Cortex XDR to block specific powershell script

[elzahy]

Hello Team,

I have a script that I would like to block across the entire estate.
Is there a way to achieve this in Cortex?

Thank you.

[tlmarques]

hi,
You can try add the hash script on action center- block list and add the same hash on IOC tab.

[elzahy]

Hi Tiago,

Thank you for your response. Blocking the hash is one option, but we are also concerned that the user might rename the script, resulting in a different hash value. Is there any way to block a specific command instead?

Thank you.