PSFalcon Security

[cripps477]

I am using PS falcon to send scripts, but could the scripts be seen if someone had wireshark or similar, so when psfalcon is run the script is sent encrypted and therefore secure and cannot be read?

I need to use a SFTP server which will require credentials , so ideally I need the script not to be visible, if it's encrypted this should be fine, I expect this is all secure/encrypted but I need some confirmation , can anyone help?

I am using this command to deploy scripts (using a loop):

Invoke-FalconDeploy -File .\myscript.ps1 -HostId $i.device_id

[bk-cs]

The problem is how Real-time Response works, not PSFalcon. Real-time Response sends the scripts to the target host in plaintext. I'm not aware of any method to protect any of the script content.

[cripps477]

thanks for the response. RTR sends the script in plaintext, but the connection from psfalcon /powershell to the target host that is all plaintext too or is the script sent over a secure tunnel connection with the target in plaintext to prevent viewing the script in transit? As long as the script cannot be viewed in transit that would be fine.

[bk-cs]

The Real-time Response connection itself is encrypted, only the PowerShell content is in plaintext. The script should not be visible in transit.