Cortex XDR to block specific powershell script

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Cortex XDR to block specific powershell script

L0 Member

Hello Team,

I have a script that I would like to block across the entire estate.
Is there a way to achieve this in Cortex?

Thank you.

2 REPLIES 2

L4 Transporter

hi,
You can try add the hash script on action center- block list and add the same hash on IOC tab.

If this post answers your question, please mark it as the solution.




Best regards
Tiago Marques

L0 Member

Hi Tiago,

 

 

Thank you for your response. Blocking the hash is one option, but we are also concerned that the user might rename the script, resulting in a different hash value. Is there any way to block a specific command instead?

 

Thank you. 

  • 141 Views
  • 2 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!