exclude/whiteliste certain powershell commands

[thomas.methlie]

Admins being admins like to use powershell to solve certain task. To do this they will often run a powershell file downloaded from a server, i.e:

C:\windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -ExecutionPolicy Bypass -Command iex ((New-Object System.Net.WebClient).DownloadString('https://example.com/script.ps1'))

This being an obvious red flag triggers AMP, but gives a lot of false positives in this case. 

Is there any way to exclude/whitelist something like this? Like the full command with arguments, the server from which it downloads??

Regards,

Thomas

[Ken Stieers]

They know its an issue, it was talked about at a CAB/Forum I was at recently. I feel like its "coming soon", but honestly can't remember if there was a date or version mentioned...

But they know it creates false positives and know that's an issue.

Ken