Safelist Command Obfuscation With Symbols in Secure Endpoint

[TomML]

Is there a way to safelist or create an exclusion for this benign powershell command without safelisting cmd.exe or powerhell.exe - just the actual Command parameter?  These events are classified as "Command Obfuscation With Symbols" compromises and there are several hundreds.

powershell  -NoLogo -NonInteractive -NoProfile -OutputFormat TEXT -Command "& {$v = (Get-CimInstance win32_OperatingSystem).Version.split('.'); $ver2012 = [int]$v[0] -gt 6 -or [int]$v[1] -gt 1; function replace_unallowed($s) {$s.replace('(', '[').replace(')', ']').replace('#', '_').replace('\', '_').replace('/', '_').toLower()} if($ver2012){ (Get-Counter '\Network Adapter(*)\*').CounterSamples | % {$_.InstanceName} | gu | % { foreach($na in (Get-CimInstance MSFT_NetAdapter -Namespace 'root/StandardCimv2')) { if($_ -eq (replace_unallowed $na.InterfaceDescription) -or $_ -like 'isatap.' + "$($na.DeviceID)") { $na.DeviceID, ':', $_, '|' }}}}}"

Thanks!

[hemohemoh]

One way to create an exclusion for a specific PowerShell command without safelisting cmd.exe or powershell.exe is to use the custom detection feature in Secure Endpoint. This allows you to create a custom rule that specifies the exact command line parameters that should be allowed. Here’s how you can do it:

1. In the Secure Endpoint console, navigate to Policies and select the policy you want to edit.
2. Click on the Settings tab and scroll down to the Custom Detections section.
3. Click on Add Custom Detection and select Command Line from the drop-down menu.
4. In the Command Line field, enter the exact command line parameters that you want to allow, including any symbols or special characters.
5. Set the Action to Allow and click on Save.

This will create a custom rule that allows the specified command line parameters to be executed without triggering a “Command Obfuscation With Symbols” compromise event.

[TomML]

Thanks, but I'm not seeing a way to add a Command Line exception in either the Custom Detection - Advanced or Application Control - Allowed under Outbreak Control. Also, I'm not seeing Settings tab (just Advanced Settings) when I edit a Secure Endpoint policy.