ENS exploit prevention signature and powershell

[User21257322]

Hi Heroes,

I saw in ENS expoit prevention signatures, there has some powershell related signatures and by default it's disabled. may I know for a best practice to protect against coinminner virus that invoke powershell to download malicious files, should we enable this signatures for powershell? or can you share your experience on this.

Thanks.

[Daveb3d]

Do you know the specific command line it uses?  Then we can put together a rule for it here. 

Dave

[User21257322]

Hi @Daveb3d Yes, I can see the command line by using Procmon tool, do you mean we can create an expert rule for it correct? as per the command line, looks like the virus is connecting to malicious site to download its executables and sorry currently i cant provide the command line.

[Daveb3d]

Ok..  is it using something like downloadstring or downloaddata in it?  If you can post the command line but remove the URI, that would be helpful.

Dave

[User21257322]

Hi @Daveb3d , I have sent you a private message for this. thanks.

[Daveb3d]

Responded!

[User21257322]

Thanks a lot!!! @Daveb3d