An EDR solution reports that a PowerShell script has been executed using the -EncodedCommand flag with a base64-encoded payload. What defensive control most directly prevents this technique?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because PowerShell Constrained Language Mode restricts the language features available to scripts, and script signing requirements prevent unsigned or encoded payloads from executing without an approved signature. A is wrong because port 5985 is used for WinRM/PowerShell remoting; blocking it limits remote execution but does not prevent local encoded command execution.
Full explanation below image
Full Explanation
B is correct because PowerShell Constrained Language Mode restricts the language features available to scripts, and script signing requirements prevent unsigned or encoded payloads from executing without an approved signature. A is wrong because port 5985 is used for WinRM/PowerShell remoting; blocking it limits remote execution but does not prevent local encoded command execution. C is wrong because WSH controls VBScript and JScript execution, not PowerShell. D is wrong because Windows Error Reporting is a diagnostic service unrelated to script execution control.