An EDR solution reports that a PowerShell script has been executed using the -EncodedCommand flag with a base64-encoded payload. What defensive control most directly prevents this technique?
Select an answer to reveal the explanation.
Short Explanation
Here's the deal — enabling PowerShell Constrained Language Mode and requiring script signing via execution policy is the control that directly stops encoded PowerShell payloads. It restricts what scripts can do and blocks unsigned or encoded commands from running without an approved signature.
Full Explanation
Enabling PowerShell Constrained Language Mode and requiring script signing via execution policy is correct because Constrained Language Mode restricts the language features available to scripts, and script signing requirements prevent unsigned or encoded payloads from executing without an approved signature. Blocking TCP port 5985 at the host firewall is wrong because port 5985 is used for WinRM/PowerShell remoting; blocking it limits remote execution but does not prevent local encoded command execution. Disabling the Windows Script Host is wrong because WSH controls VBScript and JScript execution, not PowerShell. Enabling Windows Error Reporting is wrong because Windows Error Reporting is a diagnostic service unrelated to script execution control.