Allowlist Authorized Scripts
Description
Use technical controls, such as digital signatures and version control, to ensure that only authorized scripts, such as specific .ps1, .py, etc., files, are allowed to execute. Block unauthorized scripts from executing. Reassess bi-annually, or more frequently.
Implementation Checklist
Tool Recommendations
IT asset management and software asset management platform with license optimization and SaaS management
Flexera · Enterprise subscription
Unified endpoint management platform for device enrollment, software deployment, configuration, and compliance across Windows, macOS, iOS, and Android
Microsoft · Per-user/per-device subscription
Digital workspace platform combining UEM with virtual app delivery and zero-trust access for endpoint management
Broadcom (VMware) · Per-device subscription
Threats & Vulnerabilities (CIS RAM)
Threat Scenarios
Malicious PowerShell or Python Script Execution
ConfidentialityAttackers execute obfuscated PowerShell, Python, or other scripts to download additional payloads, dump credentials, or establish reverse shells without restriction.
Fileless Malware via Script Engines
IntegrityThreat actors leverage unrestricted script execution to run fileless malware entirely in memory through scripting engines, evading traditional file-based detection.
Insider Threat via Unauthorized Automation Scripts
ConfidentialityMalicious insiders create scripts to automate data collection and exfiltration, bulk-modify system configurations, or escalate privileges without detection.
Vulnerabilities (When Safeguard Absent)
Unrestricted Script Execution on Endpoints
Without script allowlisting or code signing requirements, any script file can execute on enterprise assets, making script engines a primary attack vector.
No Version Control or Signing for Scripts
The absence of digital signature verification for scripts means modified or malicious scripts cannot be distinguished from legitimate automation.
Evidence Requirements
| Type | Evidence Item | Collection Frequency |
|---|---|---|
| Technical | Configuration screenshots or exports showing protection controls enabled | Captured quarterly |
| Document | Procedure documentation for protection measures | Reviewed annually |
| Document | Governing policy document (current, approved, communicated) | Reviewed annually |