Use technical controls, such as digital signatures and version control, to ensure that only authorized scripts, such as specific .ps1 and .py files, are allowed to execute. Block unauthorized scripts from executing. Reassess bi-annually, or more frequently.
| Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name | Notes |
|---|---|---|---|---|---|
| CIS-2.7 | Allowlist Authorized Scripts | mitigates | T1546.013 | PowerShell Profile |
Comments
PowerShell profile persistence relies on executing a script at interpreter startup. Script allowlisting prevents unauthorized profile scripts from executing.
References
|
| CIS-2.7 | Allowlist Authorized Scripts | mitigates | T1216 | System Script Proxy Execution |
Comments
If script payload execution is enforced regardless of invoking binary, proxy-based script execution is reduced.
References
|
| CIS-2.7 | Allowlist Authorized Scripts | mitigates | T1137.001 | Office Template Macros |
Comments
Macro scripts blocked if script enforcement applies to macro execution policies.
References
|
| CIS-2.7 | Allowlist Authorized Scripts | mitigates | T1037 | Boot or Logon Initialization Scripts |
Comments
Startup scripts not on the allowlist cannot execute, disrupting persistence.
References
|
| CIS-2.7 | Allowlist Authorized Scripts | mitigates | T1059.007 | JavaScript |
Comments
Script enforcement blocks execution of non-authorized JavaScript files invoked via host interpreters.
References
|
| CIS-2.7 | Allowlist Authorized Scripts | mitigates | T1059.006 | Python |
Comments
Unauthorized Python scripts are blocked when interpreter policies enforce script validation.
References
|
| CIS-2.7 | Allowlist Authorized Scripts | mitigates | T1059.005 | Visual Basic |
Comments
Malicious VB scripts/macros are prevented if not allowlisted.
References
|
| CIS-2.7 | Allowlist Authorized Scripts | mitigates | T1059.004 | Unix Shell |
Comments
Unauthorized shell scripts fail execution when enforced through script hash/signature/path validation.
References
|
| CIS-2.7 | Allowlist Authorized Scripts | mitigates | T1059.003 | Windows Command Shell |
Comments
Non-authorized batch or shell scripts are blocked.
References
|
| CIS-2.7 | Allowlist Authorized Scripts | mitigates | T1059.002 | AppleScript |
Comments
Script allowlisting prevents execution of unauthorized AppleScript files under enforced script validation policies.
References
|
| CIS-2.7 | Allowlist Authorized Scripts | mitigates | T1059.001 | PowerShell |
Comments
Unauthorized PowerShell scripts fail execution under enforced script allowlisting.
References
|