ENS rules for blocking threats from Powershell

[MartinsVinici]

Hi!

I need to create a set of rules in my environment in the ENS tools to block possible malicious activities involving Porwershell.

The objective is not to block Powershell completely, but rather macros, exploits, and other possible threats that may arise from the use of Powershell by malicious entities.

What are the recommendations for creating these rules?

[Daveb3d]

1) Enable AMSI in TP and the AMSI integration in ATP.
2) Enable the AMSI protection rules in Exploit Prevention.

3) you can create custom rules like this to block specific command lines:

Rule {
	Process {
		Exclude OBJECT_NAME {
			-v "ParentProcessIwanttoAllow1.exe"
			-v "ParentProcessIwanttoAllow2.exe"
		}
	}
	Target {
		Match PROCESS {
			Include DESCRIPTION {
				-v "Windows PowerShell"
			}
			Include PROCESS_CMD_LINE { 
				-v "* -e *"
				-v "* -en *"
				-v "* -enc *"
				-v "*webrequest*"
				-v "*iwr*"
			}
			Exclude PROCESS_CMD_LINE { 
				-v "*excludedString1*"
				-v "*excludedString2*"
			}
			Include -access "CREATE"
		}
	}
}

If they get long you can break them up into chunks:

Rule {
	Process {
		Exclude OBJECT_NAME {
			-v "ParentProcessIwanttoAllow1.exe"
			-v "ParentProcessIwanttoAllow2.exe"
		}
	}
	Target {
		Match PROCESS {
			Include DESCRIPTION {
				-v "Windows PowerShell"
			}
			Include AggregateMatch {
				Include PROCESS_CMD_LINE { 
					-v "* -e *"
					-v "* -en *"
					-v "* -enc *"
				}
				Exclude PROCESS_CMD_LINE { 
					-v "*excludedString1*"
					-v "*excludedString2*"
				}
			}
			Include AggregateMatch {
				Include PROCESS_CMD_LINE { 
					-v "*webrequest*"
					-v "*iwr*"
				}
				Exclude PROCESS_CMD_LINE { 
					-v "*excludedString1*"
					-v "*excludedString2*"
				}
			}
			Include -access "CREATE"
		}
	}
}

Test them thoroughly just monitoring them before blocking.  Excluded strings or parent processes as it makes sense.