McAfee ATP rules for blocking/preventing unauthorized use of PowerShell

[GirishModakM]

Hello Team,

We are planning to disable PowerShell Completely in our environment. But we see it may cause many issues if we block it completely.

Can we use McAfee ATP to allow PowerShell in secure mode & it should block/prevent unauthorized use of PowerShell. I browsed  KB82925, but I can see many Rules that can prevent PowerShell unauthorized access. Can you please suggest which exact rule can be enabled with less false positives to prevent unauthorized PowerShell access?

thanks

Girish 

[yaz]

Hi @GirishModakM 

Thanks for reaching out to community. 

Based on the provided details, it looks like you needed to fine tune McAfee ATP / DAC rules to block powershell from unauthorized execution. 

Unfortunately, we cannot guarantee on the exact rules that overcome your requirements but certainly we can check on this internally and do the best from our end. 

I suggest you can raise an SR with our support so that we can also have complete details on your requirements and suggest best practices accordingly. 

Was my reply helpful?

If yes, please give me a Kudo. If I have answered your query, kindly mark this as solution so that together we help other community members. 

[Daveb3d]

What do you mean by secure mode?  Constrained language mode?  

[GirishModakM]

@Daveb3d  I mean to say Secure mode means, preventing unauthorized use of PS by enabling ATP rules. Any specific rule that we can enable?