Reply to thread

Message

<blockquote data-quote="Gandalf_The_Grey" data-source="post: 725536" data-attributes="member: 52096">I think it&#039;s not really a FP: when using [USER=32260]@Andy Ful[/USER] &#039;s Configure Defender the powershell commands gets blocked:[CODE]Date/Time: 7-4-2018 18:35:53Process: [2796]C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeParent: [8012]D:\Downloads\Software\ConfigureDefender_1.0.0.1\ConfigureDefender_x64.exeRule: BlockPowerShellMalformedCommandsRule Name: Block execution of PowerShell malformed commandsCommand Line: c:\Windows\System32\WindowsPowerShell\v1.0\PowerShell -NonInteractive -WindowStyle hidden $Preferences=Get-MpPreference;$path=&#039;HKLM:\SOFTWARE\Policies\Microsoft\Windows\safer_Hard_Configurator\Defender\TEMP&#039;; New-ItemProperty -Path $path -Name &#039;PreferencesTest&#039; -Value $Preferences.DisableRealtimeMonitoring -PropertyType String -Force | Out-Null; function SetRegistryKey ([string]$name){$svalue=$Preferences.$name;New-ItemProperty -Path $path -Name $name -Value $svalue -PropertyType DWORD -Force | Out-Null}; SetRegistryKey(&#039;EnableNetworkProtection&#039;); SetRegistryKey( &#039;EnableControlledFolderAccess&#039;);SetRegistryKey(&#039;DisableRealtimeMonitoring&#039;); SetRegistryKey(&#039;DisableBehaviorMonitoring&#039;); SetRegistryKey(&#039;DisableBlockAtFirstSeen&#039;); SetRegistryKey(&#039;MAPSReporting&#039;);SetRegistryKey(&#039;SubmitSamplesConsent&#039;);SetRegistryKey(&#039;DisableIOAVProtection&#039;); SetRegistryKey(&#039;DisableScriptScanning&#039;); SetRegistryKey(&#039;PUAProtection&#039;); SetRegistryKey(&#039;ScanAvgCPULoadFactor&#039;);Signer:Parent Signer:User/Domain:Integrity Level: High[/CODE]Made an exclusion: [CODE][%PROCESS%: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe] [%PROCESSCMDLINE%: c:\Windows\System32\WindowsPowerShell\v1.0\PowerShell -NonInteractive -WindowStyle hidden $Preferences=Get-MpPreference;$path=&#039;HKLM:\SOFTWARE\Policies\Microsoft\Windows\safer_Hard_Configurator\Defender\TEMP&#039;; New-ItemProperty -Path $path -Name &#039;PreferencesTest&#039; -Value $Preferences.DisableRealtimeMonitoring -PropertyType String -Force | Out-Null; function SetRegistryKey ([string]$name){$svalue=$Preferences.$name;New-ItemProperty -Path $path -Name $name -Value $svalue -PropertyType DWORD -Force | Out-Null}; SetRegistryKey(&#039;EnableNetworkProtection&#039;); SetRegistryKey( &#039;EnableControlledFolderAccess&#039;);SetRegistryKey(&#039;DisableRealtimeMonitoring&#039;); SetRegistryKey(&#039;DisableBehaviorMonitoring&#039;); SetRegistryKey(&#039;DisableBlockAtFirstSeen&#039;); SetRegistryKey(&#039;MAPSReporting&#039;);SetRegistryKey(&#039;SubmitSamplesConsent&#039;);SetRegistryKey(&#039;DisableIOAVProtection&#039;); SetRegistryKey(&#039;DisableScriptScanning&#039;); SetRegistryKey(&#039;PUAProtection&#039;); SetRegistryKey(&#039;ScanAvgCPULoadFactor&#039;);] [%PARENTPROCESS%: D:\Downloads\Software\ConfigureDefender_1.0.0.1\ConfigureDefender_x64.exe][/CODE]And all is working fine <img src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7" class="smilie smilie--sprite smilie--sprite130" alt="(y)" title="Thumbs up&nbsp; &nbsp; (y)" loading="lazy" data-shortname="(y)" /></blockquote>

[QUOTE="Gandalf_The_Grey, post: 725536, member: 52096"] I think it's not really a FP: when using [USER=32260]@Andy Ful[/USER] 's Configure Defender the powershell commands gets blocked: [CODE]Date/Time: 7-4-2018 18:35:53 Process: [2796]C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Parent: [8012]D:\Downloads\Software\ConfigureDefender_1.0.0.1\ConfigureDefender_x64.exe Rule: BlockPowerShellMalformedCommands Rule Name: Block execution of PowerShell malformed commands Command Line: c:\Windows\System32\WindowsPowerShell\v1.0\PowerShell -NonInteractive -WindowStyle hidden $Preferences=Get-MpPreference;$path='HKLM:\SOFTWARE\Policies\Microsoft\Windows\safer_Hard_Configurator\Defender\TEMP'; New-ItemProperty -Path $path -Name 'PreferencesTest' -Value $Preferences.DisableRealtimeMonitoring -PropertyType String -Force | Out-Null; function SetRegistryKey ([string]$name){$svalue=$Preferences.$name;New-ItemProperty -Path $path -Name $name -Value $svalue -PropertyType DWORD -Force | Out-Null}; SetRegistryKey('EnableNetworkProtection'); SetRegistryKey( 'EnableControlledFolderAccess');SetRegistryKey('DisableRealtimeMonitoring'); SetRegistryKey('DisableBehaviorMonitoring'); SetRegistryKey('DisableBlockAtFirstSeen'); SetRegistryKey('MAPSReporting');SetRegistryKey('SubmitSamplesConsent');SetRegistryKey('DisableIOAVProtection'); SetRegistryKey('DisableScriptScanning'); SetRegistryKey('PUAProtection'); SetRegistryKey('ScanAvgCPULoadFactor'); Signer: Parent Signer: User/Domain: Integrity Level: High[/CODE] Made an exclusion: [CODE][%PROCESS%: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe] [%PROCESSCMDLINE%: c:\Windows\System32\WindowsPowerShell\v1.0\PowerShell -NonInteractive -WindowStyle hidden $Preferences=Get-MpPreference;$path='HKLM:\SOFTWARE\Policies\Microsoft\Windows\safer_Hard_Configurator\Defender\TEMP'; New-ItemProperty -Path $path -Name 'PreferencesTest' -Value $Preferences.DisableRealtimeMonitoring -PropertyType String -Force | Out-Null; function SetRegistryKey ([string]$name){$svalue=$Preferences.$name;New-ItemProperty -Path $path -Name $name -Value $svalue -PropertyType DWORD -Force | Out-Null}; SetRegistryKey('EnableNetworkProtection'); SetRegistryKey( 'EnableControlledFolderAccess');SetRegistryKey('DisableRealtimeMonitoring'); SetRegistryKey('DisableBehaviorMonitoring'); SetRegistryKey('DisableBlockAtFirstSeen'); SetRegistryKey('MAPSReporting');SetRegistryKey('SubmitSamplesConsent');SetRegistryKey('DisableIOAVProtection'); SetRegistryKey('DisableScriptScanning'); SetRegistryKey('PUAProtection'); SetRegistryKey('ScanAvgCPULoadFactor');] [%PARENTPROCESS%: D:\Downloads\Software\ConfigureDefender_1.0.0.1\ConfigureDefender_x64.exe][/CODE] And all is working fine (y) [/QUOTE]

Verification