Skip to main content

telos_agent/tools/command_security/powershell/
read_only.rs

1use crate::tools::command_security::powershell::aliases::canonical_command_name;
2use crate::tools::command_security::powershell::parser::ParsedCommandElement;
3
4pub fn is_read_only_command(cmd: &ParsedCommandElement) -> bool {
5    matches!(
6        canonical_command_name(&cmd.name).as_str(),
7        "Get-ChildItem"
8            | "Get-Content"
9            | "Get-Item"
10            | "Get-Location"
11            | "Get-Process"
12            | "Get-Service"
13            | "Get-FileHash"
14            | "Select-String"
15            | "Test-Path"
16            | "Resolve-Path"
17            | "Write-Output"
18    )
19}