How to Powershell malicious check

[Samuel-Setiawan]

Hi, im need to Powershell malicious check i Cortex XDR with  Instance Administrator console role, how can i do?

[aspatil · Accepted solution]

Hello Samuel,

Thank you for writing to live community!

The Cortex XDR Agent features Behavioral Threat Protection modules leverages the Anti-Malware Scan Interface (AMSI) to block PowerShell scripts.

To create a BIOC rule, please check out Live Community How-to video Script Block Query and BIOC | Palo Alto Networks

Hope this helps!

Please mark the response as "Accept as Solution" if it answers your query.

Regards.