McAfee ENS: Illegal API Injection / Solution

[aendieh]

Issue and Steps to Reproduce

Upgrade configuration and use powershell directly in order for ENS not to alert an illegal api injection.
This requires a config change for the powershell wrapper, not using cmd \c as a prefix.

Background:

The latest version of McAfee's ENS blocks the cmd \c wrapper for powershell as it is an illegal api injection.
The command shown does not give any hints in what is actually executed and will be blocked every now and then, which leads to a flapping service.

Threat Target Process Name: POWERSHELL.EXE
Target Parent Process Name: CMD.EXE
Target Name: POWERSHELL.EXE
Target File Path: C:\WINDOWS\SYSTEM32\WINDOWSPOWERSHELL\V1.0\POWERSHELL.EXE
Threat Target User Name: NT AUTHORITY\SYSTEM
Module Name: Threat Prevention
Action Taken: Blocked
Source Description: powershell.exe -noprofile -command -

change 
cmd /c echo try { scripts\%SCRIPT% %ARGS%; exit($lastexitcode) } catch { Write-Host $_; exit(3) } | %SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe -noprofile -command -
to
powershell.exe -noprofile -command "try { scripts\%SCRIPT% %ARGS%; exit($lastexitcode) } catch { Write-Host $_; exit(3) }"

This requires Powershell Version 3.0 + on the server in order to work.