Hi folks,

I'm new to snort and openappid.  Was curious if there was an openappid signature for powershell? I've looked in various areas within snort / openappid categories but not finding it.  

Does this exist? I want to block powershell from leaving my network.

JJ