Exception to prevent the blocking of the Powershell/CMD command

[Aristooo]

Hi. How can I create an exception to prevent specific PowerShell and CMD commands from being blocked by XDR?
Cortex XDR  

[jmazzeo · Accepted solution]

Hi @Aristooo, thanks for reaching us using the Live Community.

You can try by creating a Disable Prevention Rule under Configuration - Exceptions Configuration.

You can there enter the command that you need to create the exception, in the "Command line" field. Select the right module by choosing the one that is blocking the process in your case, I have selected BTP for the example which is the common one.

If this post answers your question, please mark it as the solution.

[Aristooo]

Hi @jmazzeo ,  thanks for your response!

In the CMD Line under Target Properties, can I replace some arguments with *? For example, to capture all arguments in that part of the command. Like replacing "curl https://paloaltonetworks.com --show-error" with "curl https://* --show-error".

[jmazzeo]

Yes, you can use the asterisk as a wildcard.

[Aristooo]

@jmazzeo thank you very much!

[TurkanAsadova]

Hi Cortex XDR Community,

I want to set up an alert in Cortex XDR that triggers whenever any user runs a PowerShell script. The alert should activate for any script or command executed in PowerShell, regardless of the user or specific script.

Is there an existing rule or method to create such an alert for PowerShell usage? Any suggestions or examples would be appreciated.

Thanks in advance!