Defining attribute-based rules for file execution

Context-based allowing or blocking of files — On a protected system, only allow listed interpreters are permitted to execute. But, in certain scenarios, allow listed interpreters might be misused to execute malicious scripts. For example, a powershell.exe script can be used to execute unsolidified scripts and execute file-less scripts by invoking its execution with atypical input arguments. You can prevent misuse of interpreters by defining attribute-based rules to block potentially malicious scenarios.

Flexibility and control — Attribute-based rules provide flexibility to allow or block file execution, as needed. You might need to block a user from running a specific file. If an administrator wants to block the execution of powershell.exefor a specific user, a rule can be added to prevent its execution. You can achieve such scenarios using attribute-based rules.

Similarly, you might choose to block execution of a certain file in your setup completely, unless when run by a specific parent process. You can achieve this by creating a generic block rule and a parent process-based allow rule for the file. Because the allow rule has precedence over the block rule, it overrides the block rule when applied.

Or, you might choose to only observe or monitor a file to determine its execution in your setup. To do this, you can define a monitor rule for the file.

Note

We recommend that before creating a block rule for a file, create a monitor rule to observe the file's use and execution in your setup. After you define the monitoring rule, if no OBSERVED_FILE_EXECUTION events are generated for the file over a reasonable time window, you can safely define a block rule for a file.