Reply to thread

Message

<blockquote data-quote="simmerskool" data-source="post: 1040306" data-attributes="member: 61091">FYI Di Dashboard &amp; my 2 powershell script blocked events. It is not displayed on Main screen, it can be found 2 more clicks in, Events | default opens to Malicious so next click is next to Malicious | Suspicious Events.CyF tech suggested change Powershell setting &quot;to detect instead of prevent.&quot;Something to consider, or not?&nbsp; <img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite132" alt=":unsure:" title="Unsure&nbsp; &nbsp; :unsure:" loading="lazy" data-shortname=":unsure:" />EDIT: for now I followed CyF tech advice | changed prevent to detect. so I think (suspect) that Di can tell the difference from &quot;normal&quot; not malicious (not generally malicious) powershell event from a malicious one, and it may block a malicious one based on another setting: that is, the way mine was set was too tight, I don&#039;t know for sure, that&#039;s a level I&#039;m not at yet. <img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite133" alt=":whistle:" title="Whistling&nbsp; &nbsp; :whistle:" loading="lazy" data-shortname=":whistle:" /></blockquote>

[QUOTE="simmerskool, post: 1040306, member: 61091"] FYI Di Dashboard & my 2 powershell script blocked events. It is not displayed on Main screen, it can be found 2 more clicks in, Events | default opens to Malicious so next click is next to Malicious | Suspicious Events. CyF tech suggested change Powershell setting "to detect instead of prevent." Something to consider, or not? :unsure: EDIT: for now I followed CyF tech advice | changed prevent to detect. so I think (suspect) that Di can tell the difference from "normal" not malicious (not generally malicious) powershell event from a malicious one, and it may block a malicious one based on another setting: that is, the way mine was set was too tight, I don't know for sure, that's a level I'm not at yet. :whistle: [/QUOTE]

Verification