Block specific PowerShell parameters

This example rule prevents PowerShell from executing with specific command-line parameters, except for the encoded command, which is "dir c:\program files".

Note

Exploit Prevention is not supported in the ARM architecture.

Rule {
	Process { 
		Include OBJECT_NAME      { -v "*PowerShell*" }
		Include PROCESS_CMD_LINE { -v "*-NoLogo*" }
		Include PROCESS_CMD_LINE { -v "*-File*" }
		Include PROCESS_CMD_LINE { -v "*-EncodedCommand*" }
		Include PROCESS_CMD_LINE { -v "*-Command*" }
		Exclude PROCESS_CMD_LINE { -v "*-EncodedCommand
				ZABpAHIAIAAnAGMAOgBcAHAAcgBvAGcAcgBhAG0AIABmAGkAbABlAHMAJwAgAA==" }
	}
	Target {
		Match SECTION { Include -access "CREATE" }
	}
}

For more Expert Rules examples, visit the Trellix Github repository.