Environment
- Carbon Black Cloud Sensor: 3.6.x - 3.8.0.627
- Microsoft Windows: All Supported Versions
Symptoms
Seeing events similar to:
The application powershell_ise.exe attempted to execute fileless content in order to evade inspection. A Deny policy action was applied.
CMD:
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoExit -Command Help Set-ExecutionPolicy
Cause
Resolution