Powershell tools trigger security alerts
- Ngôn ngữ chính
- Shell
- Star
- 11.2k
- Fork
- 1.9k
- Merge trung bình
- 14 giờ 16 phút
- Pull request đã merge (30 ngày)
- 6
Mô tả
### Describe the bug
Whenever I use GitHub Copilot CLI I get IMs from Security Operations saying my machine is triggering alerts.
Specifically, it looks like Elastic has a [built-in rule](https://www.elastic.co/docs/reference/security/prebuilt-rules/rules/windows/defense_evasion_clearing_windows_console_history) called "Clearing Windows Console History" that looks for Powershell commands with `Set-PSReadLineOption` and `SaveNothing`. It appears GitHub Copilot CLI does this for at least some Powershell tool invocations.
### Affected version
GitHub Copilot CLI 0.0.406
### Steps to reproduce the behavior
1. Run a prompt that will invoke Powershell.
2. See a new process spawned `pwsh.exe -nop -nol -noe -c Set-PSReadLineOption -HistorySaveStyle SaveNothing`
### Expected behavior
GitHub Copilot CLI should not explicitly disable or clear Powershell command history
### Additional context
**Operating System:** Windows 11
**Terminal:** Windows Terminal
**Shell:** Powershell 7.5.4
Hướng dẫn đóng góp
Đánh giá
Issue này chưa được đánh giá.