Application Control performs multiple checks to determine whether to allow or block a file's execution. If a file's execution is allowed after the Application Control checks, attribute-based or granular rules, if any are defined, come into play. The rules are based on the concept of fine-grained allow listing and can be created on the attributes of a file.
You can define specific rules using attributes to allow, block, or monitor the file. Rules that allow execution take precedence over rules that block or monitor execution.
Attribute-based rules help you allow or block files in different scenarios based on file context. On a protected system, only allow listed interpreters are permitted to run. But, in certain scenarios, allow listed interpreters might be misused to execute malicious scripts. You can prevent misuse of interpreters by defining attribute-based rules to block potentially malicious scenarios.
Attribute-based rules provide flexibility to allow or block file execution, as needed. If an administrator needs to block a user from running a specific file, they can add an attribute-based rule to prevent its execution by that user. Similarly, an administrator can choose to block execution of a certain file altogether, unless when run by a specific parent process.
Tip
We recommend that before creating a block rule for a file, create a monitor rule to observe the file's use and execution in your setup. After you define the monitoring rule, if no OBSERVED_FILE_EXECUTION events are generated for the file over a reasonable time window, you can safely define a block rule for a file. But, the applied rules are ineffective when the system is in update mode, observe mode, or when any process is selected as updater process and only the events are generated.