Hi,

I would like to block some commands from being executed directly in Powershell.

However, I can prevent it when the "powerhell -Invoke-Command" is run over CMD, which I can do in "Exploit prevention". But it does not block this command when I open and run the powershell screen directly. How do I prevent it from running on Powershell screen.

Do I need a parameter to mark the Powershell command line?

The rule I blocked when running from CMD is explained below;

"Exploit Prevention Expert Rule"

Rule { 

    Process {

Include OBJECT_NAME { v "*PowerShell*" }

Include PROCESS_CMD_LINE { v "*Invoke-Command*"}

}

Target  {

Match SECTION { Include -access "CREATE" ; }

} 

}