Fully Block cmdlets like "invoke-expression"

PowerShell Protect
1

Hi all,

is there any way to completely block cmdlets like “invoke-expression”?

The default behavior only hits “invoke-expression” or “iex”, but I can run “Microsoft.PowerShell.Utility\Invoke-Expression ‘Get-Random’” and it works completely. It seems that all blocked commands work when called with their fully qualified name.

2

The blocking procedure is all based on static script analysis so we will need to update the rule to improve this particular case. You could also put in a custom rule that checks for the fully qualified name.