Problem with PowerShell security rules that use process.args

Elastic Security
3

Hi,

I did use the windows and defend integration. I tested it the wrong way

image
image1432×200 24.3 KB

In the first log entry we do get the arguments and the process is ran like this:

powershell.exe Set-NetFirewallProfile -Enabled True

In the second one we do not get the arguments and the process is ran like this:

Set-NetFirewallProfile -Enabled False