Script control

For each type of script, you can select one of the following actions:

You can find script control alert and block events in the

Protection > Script Control

screen. 

This setting controls whether you want to allow Active Scripts to run, or block them from running. Active Scripts include VBScript and JScript.

For agent version 1.2.1370 and earlier, there is one action setting for both Active Script and PowerShell. For agent 1.2.1380 and later, you need to set them individually.

This setting controls whether you want to allow  scripts to run, or block them from running.

For agent version 1.2.1370 and earlier, there is one action setting for both Active Script and PowerShell. For agent version 1.2.1380 and later, you need to set them individually.

This setting controls whether you want to block the PowerShell console from launching for devices running agent version 1.2.1380 or later. Blocking the PowerShell console provides additional security by protecting against the use of PowerShell one-liners.

This setting is available when the action for PowerShell scripts are set to

Block

.

This setting controls whether to alert or block

Microsoft Office

macros. Macros use Visual Basic for Applications (VBA) which allows embedding code inside a

Microsoft Office

document (typically

Microsoft Word

,

Excel

, and

PowerPoint

). The main purpose for macros is to simplify routine actions, like manipulating data in a spreadsheet or formatting text in a document. However, malware creators can use macros to run commands and attack the system. It is assumed that a macro is performing a malicious action when it tries to manipulate the system. The agent looks for malicious actions originating from a macro that affects anything outside the

Microsoft Office

products.

This setting controls whether to allow Python scripts (version 2.7 and 3.0 to 3.8), or block them from running. This setting is valid for agent 1580 or later.

This setting controls whether to allow .NET DLR scripts to run, or block them from running. This setting is valid for agent 1580 or later.

This setting controls whether

CylancePROTECT Desktop

allows

Excel

4.0 (XLM) macros to run, or blocks them from running. When macros are enabled and executed, the

Microsoft

AMSI interface communicates with the agent to determine whether to allow the macro to run or to block it according to the device policy.

This feature requires the following:

Microsoft Windows
10 or later
CylancePROTECT Desktop
agent version 3.1
VBA macros must be disabled in the
Excel
File > Trust Center > Excel Trust Center > Macro Settings
menu.

You can specify whether to disable script control for certain script types. When you disable script control, scripts are allowed to run and you do not receive alerts.

You can specify folders to allow any script in that folder (and sub-folders) to execute without generating an alert, even when script controls are set to block. You can also add exclusions for processes to allow scripts from certain applications to run properly that would otherwise be blocked.  For example, if the IT department uses specific tools to run scripts all the time, you can add the process for that tool as an exclusion so that scripts can be run through that tool.

You specify the relative path of the folder or sub-folder. The folder paths can be to a local drive, a mapped network drive, or a universal naming convention (UNC) path.