Forum Discussion

AARM00502's avatar
AARM00502
Icon for Altostratus rankAltostratus
Jul 12, 2024

Windows PowerShell "cp" execution attempt (Parameter)

Hello everyone. In a security policy I am alarmed by an attack signature due to the detection of "cp", this identifies it as a command, however, it is part of the character string that is used to fil...
security
AARM00502's avatar
AARM00502
Icon for Altostratus rankAltostratus

So there is no signature that can be used to avoid leaving that area uncovered? That is to say, so that the execution of malicious commands is not allowed, without this macho with some other string of characters. 

zamroni777's avatar
zamroni777
Icon for Nacreous rankNacreous
Jul 25, 2024

waf config needs to involve application team.
if they can ensure that those input data will not be executed in windows powershell, then you can unblock that particular filter.