Detect/Precent powershell execution

kiikoo15 — Mon, 07 Jul 2025 15:41:47 GMT

Hello everyone,

I would like to ask what is the best approach to prevent and/or monitor the execution of PowerShell scripts or even the use of the PowerShell application on the computers in my IT environment, using Check Point Endpoint Security.

My objectives are:

Preventing PowerShell execution (in cases where it's not required by end users);
Detecting/alerting when PowerShell is executed — especially in suspicious contexts (e.g., powershell.exe -Encoded Command, etc.);
Monitoring or blocking the creation/execution of Scheduled Tasks (schtasks.exe), which are often used for malicious persistence.

Specific questions:

Is it possible to create block rules to prevent PowerShell usage, while allowing exceptions if needed?
Are there ways to generate alerts or detailed logs when PowerShell is executed (even if it's legitimate)?
Does Harmony Endpoint allow for visibility over suspicious scheduled task creation?
Are there any best practices or recommended profiles to mitigate this type of behavior?

I appreciate any guidance or sharing of experiences with these configurations.

Best regards,
K

Re: Detect/Precent powershell execution

lluner — Mon, 07 Jul 2025 19:28:03 GMT

@kiikoo15

I believe that first you could use this functionality below:

Configuring Application Permissions in the Application Control Policy

topic Detect/Precent powershell execution in Endpoint

Detect/Precent powershell execution

Specific questions:

Re: Detect/Precent powershell execution