Hi Cyber1985, There's some Windows nuance happening here which is tripping you up. When you used CMD to launch Powershell, Cortex examined the command line arguments passed to powershell (i.e. powershell.exe wget [site_url]) and was able to match "wget", however, when you type "wget" into an interactive Powershell window, there are no command line arguments to examine, it all happens within the interactive shell without spawning a subprocess as was the case with CMD. To detect this, you will need to have Powershell logging enabled shown here from Microsoft, https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_logging_windows?view=powershell-7.2. Assuming you have Cortex XDR Pro per Endpoint, Windows Event logs are ingested and can be searched.
... View more