Thank you Pete for your insight.
BTW, it looks like VS was bypassed!!!!!!
Current state of malicious Powershell script blocking
Ooops. Nope, it wasn't. Another false alarm from the testing squad... so the squad's false alarm rate remains at 100%.
Here is why it is not a bypass...
The attacker must be able to automatically run the command prompt or macro... then it will be a bypass.
The problem is that VS is going to block the command prompt or the macro long before the attacker has a chance to run their command line.
Think of it this way... if the user opens a command prompt (which VS allows command prompts if the user launched it), and runs the format d: command, VS will not block that either.
If I am missing something, please let me know.
BTW, White Cipher is just a silly "alter-ego" I came up with in reaction to Black Cipher's youtube videos

.
VoodooShield ?