Environment
- CB Protection Server: All versions
- CB Protection Agents: All versions
Objective
Is it possible to block wscript from running .vbs scripts?
Resolution
Yes, if the environment is configured to find .vbs files interesting.
Additional Notes
- .vbs files themselves are only interesting because one can enable a Visual Basic script rule to enable tracking of those. However a tool like wscript.exe doesn't care when the filename is called when you run it. If wscript.exe is approved on an endpoint, it can run any file, with any extension (or no extension). It's just a script processor.
- Choose to create a reporting rule to track any wscript.exe executions in order to review for malicious behavior, or simply block wscript.exe in the environment, and then create allow rules where needed for the tool to run in specific instances. Otherwise, wscript has no restrictions on what is run as long as wscript.exe is approved.
Related Content
