New-NetFirewallRule -Group "LOLBAS" -DisplayName "LOLBAS rule for: cscript_32.exe" -Program "%SystemRoot%\System32\cscript.exe" -Direction Outbound -Action Block
New-NetFirewallRule -Group "LOLBAS" -DisplayName "LOLBAS rule for: cscript_64.exe" -Program "%SystemRoot%\SysWOW64\cscript.exe" -Direction Outbound -Action Block
New-NetFirewallRule -Group "LOLBAS" -DisplayName "LOLBAS rule for: powershell_32.exe" -Program "%SystemRoot%\System32\WindowsPowerShell\v1.0\powershell.exe" -Direction Outbound -Action Block
New-NetFirewallRule -Group "LOLBAS" -DisplayName "LOLBAS rule for: powershell_64.exe" -Program "%SystemRoot%\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -Direction Outbound -Action Block
New-NetFirewallRule -Group "LOLBAS" -DisplayName "LOLBAS rule for: powershell_ise_32.exe" -Program "%SystemRoot%\System32\WindowsPowerShell\v1.0\powershell_ise.exe" -Direction Outbound -Action Block
New-NetFirewallRule -Group "LOLBAS" -DisplayName "LOLBAS rule for: powershell_ise_64.exe" -Program "%SystemRoot%\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe" -Direction Outbound -Action Block
New-NetFirewallRule -Group "LOLBAS" -DisplayName "LOLBAS rule for: regsvr32_32.exe" -Program "%SystemRoot%\System32\regsvr32.exe" -Direction Outbound -Action Block
New-NetFirewallRule -Group "LOLBAS" -DisplayName "LOLBAS rule for: regsvr32_64.exe" -Program "%SystemRoot%\SysWOW64\regsvr32.exe" -Direction Outbound -Action Block
New-NetFirewallRule -Group "LOLBAS" -DisplayName "LOLBAS rule for: rundll32_32.exe" -Program "%SystemRoot%\System32\rundll32.exe" -Direction Outbound -Action Block
New-NetFirewallRule -Group "LOLBAS" -DisplayName "LOLBAS rule for: rundll32_64.exe" -Program "%SystemRoot%\SysWOW64\rundll32.exe" -Direction Outbound -Action Block
New-NetFirewallRule -Group "LOLBAS" -DisplayName "LOLBAS rule for: wscript_32.exe" -Program "%SystemRoot%\System32\wscript.exe" -Direction Outbound -Action Block
New-NetFirewallRule -Group "LOLBAS" -DisplayName "LOLBAS rule for: wscript_64.exe" -Program "%SystemRoot%\SysWOW64\wscript.exe" -Direction Outbound -Action Block