Access official resources from Carbon Black experts
When using Custom Script Rules to block execution of PowerShell scripts (ps1 and psm1 files), execution of those files in PowerShell is not blocked.
Execution of a PowerShell script is not being blocked.
By default, the bundled Custom Script Rule for PowerShell uses "File Association" as the means for blocking the script. The default application in Windows for PowerShell scripts is Notepad.
Change the Windows settings so that PowerShell is the default application to launch when opening ps1 or psm1 files.
Change the rule to block "powershell.exe" instead of "File Association" by following these steps: