> The code below would work fine if it weren't for the `?` in the URL...

The `?` in the URL you posted marks the start of the _query string_. To match the query string you need to use the `QUERY_STRING` server variable in a mod_rewrite _condition_. (The `RewriteRule` _pattern_ matches against the URL-path only - this excludes the query string.)

>     RewriteRule ^.*cmd=get_file.*$ - [F,L]

This looks like you are trying to block any request that simply contains `cmd=get_file` anywhere inside the query string. To do this, you would need something like the following:

    RewriteCond %{QUERY_STRING} cmd=get_file
    RewriteRule ^ - [F]

The `L` flag is not required. It is implied when you use the `F` flag. The _regex_ `cmd=get_file` is the same as `^.*cmd=get_file.*$`. If that is sufficient then stop there.

However, this is far more general than what you stated in the first part of your question:

> ...the following part of the URL is always the same `/%24%24%24%26%3f%26%3f%24%24%24?cmd=get_file&arg=images/wslogo_block_page.png&sid=`

In order to match this specific URL (ignoring any trailing query string parameters), you would need something like:

    RewriteCond %{QUERY_STRING} ^cmd=get_file&arg=images/wslogo_block_page\.png&sid=
    RewriteRule ^\$\$\$&\?&\?\$\$\$\$$ - [F]

The "complex" part of this is matching the URL-path (ie. `/%24%24%24%26%3f%26%3f%24%24%24`). The `RewriteRule` _pattern_ matches against the %-decoded URL-path, which is `/$$$&?&?$$$` (assuming the URL you posted earlier is not doubly encoded or anything). Confusingly, this also contains `?` and other regex meta characters, so these must be backslash escaped in the regex that matches these literal characters.