cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
10990
Views
25
Helpful
21
Replies

exclude/whiteliste certain powershell commands

thomas.methlie
Level 1
Level 1

Admins being admins like to use powershell to solve certain task. To do this they will often run a powershell file downloaded from a server, i.e:

C:\windows\system32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -ExecutionPolicy Bypass -Command iex ((New-Object System.Net.WebClient).DownloadString('https://example.com/script.ps1'))

This being an obvious red flag triggers AMP, but gives a lot of false positives in this case. 

 

Is there any way to exclude/whitelist something like this? Like the full command with arguments, the server from which it downloads??

 

Regards,

Thomas

21 Replies 21

They know its an issue, it was talked about at a CAB/Forum I was at recently. I feel like its "coming soon", but honestly can't remember if there was a date or version mentioned...

But they know it creates false positives and know that's an issue.

Ken