Script Analysis Settings, Security Manager, Endpoint Manager, Xcitium

Script Analysis Settings

CCS can analyze code in executable files in two ways:

Heuristic command line analysis

Embedded Code Detection

You can enable these features and select the programs you want to monitor by adding a 'Script Analysis' section to a profile.

You can also monitor programs which try to make changes to auto-run entries, Windows services and scheduled tasks

Background:

Heuristic command line analysis:

Heuristic techniques identify previously unknown viruses and Trojans.

Files are analyzed to ascertain whether they contain code typical of a virus.

In other words, heuristics identifies files which have virus-like attributes, instead of looking for a signature that matches a signature on the blacklist.

This allows the engine to predict the existence of new viruses - even if they are not in the current virus database.

Embedded code detection:

Embedded code detection protects you against file-less malware attacks.

File-less malware attacks allow malicious actors to directly execute powershell commands on your system.

These commands can be used to take control of endpoints, install ransomware, steal confidential data and more.

File-less scripts reside in memory so no trace of them remains after the computer is restarted.

Example programs affected by this option are wscript.exe, cmd.exe, java.exe and javaw.exe.

For example, the program wscript.exe can be made to execute visual basic scripts (.vbs file extension) via a command similar to 'wscript.exe c:/tests/test.vbs'. If this option is selected, CCS detects c:/tests/test.vbs from the command-line and applies all security checks to this file.

Enabled - If test.vbs attempts to connect to the internet, the alert will state 'test.vbs' is attempting to connect to the internet

Disabled - The alert will only state 'wscript.exe' is trying to connect to the internet'.

Exclusions

Exclusion tab able to exclude and log the command line detected by script analysis by defining a regular expression . If you add exclusion the detected but excluded items shall be able to log as "ignored".

To configure 'Script Analysis' Settings

Click 'Configuration Templates' > 'Profiles'

Click the name of a Windows profile

Click 'Add Profile Section' > 'Script Analysis'

The 'Script Analysis' settings screen contains three tabs:

General Settings - Enable script analysis and set the maximum file size which should be checked.

Runtime Detection - Select which programs are monitored throughout their operation.

Autoruns Scan – Choose programs that you want to monitor to see if they make changes to auto-run entries, Windows services and scheduled tasks.

General Settings

Perform Script Analysis - Enable/Disable script analysis. CCS will only analyze the applications selected in the 'Runtime Detection' tab if this option is enabled. An alert is generated if malicious code is found in any item. (Default = Enabled)

Limit the total size of saved detected scripts to - CCS stores scripts run by managed applications for analysis. This option lets you specify the total size of stored scripts. When the set limit is reached, the older scripts are deleted automatically. (Default = 100 KB)

Runtime Detection

Lets you select executables which should be analyzed during their execution.

You can also add custom applications which you want to protect.

Click the 'Runtime Detection' tab in the 'Script Analysis' settings interface

Use the switch in the 'Heuristic Command-Line Analysis' column to enable/disable heuristic command line analysis for each application.

Use the switch in the 'Embedded Code Detection' column to enable/disable embedded code detection for each application.

Select an application and click the edit button to update its details.

Select an application and click the trash can icon to remove it from the list.

Add a Exclusion

Click Script Analysis > Runtime Detection > Exclusions
Select a application which you need to add an exclusions
Click 'Add' ,Enter an regex and click 'Ok' to save your changes

This feature will exclude and log the command line detected by script analysis by defining a regular expression.

For ex : If a malware script in the comment statement contains something that matches exclusion, that will be vulnerability and lauched .This functionality will allow to create malware that are focused on XCS.

To delete the added regex click the delete icon, and then selected regular expression will be removed.

Add a new application

Click 'Add' at the top to include a new application to the list.

Enter the name of the application in the 'Add Application' dialog and click 'Add'.

The new application will be added to the list and will be selected by default. You can use the toggle switch beside it to enable/disable it at any time.

Repeat the process to add more applications

To reset the list to the default list of applications, click 'Reset to Default' on the top

Click 'OK' to apply your changes.

Autoruns Scan

Select applications which should be monitored in case they make changes to autoruns, Windows services or scheduled tasks.

You can also add custom applications which you want to monitor.

Click the 'Autoruns Scan' tab in the 'Script Analysis' settings interface.

Use the switch in the 'Heuristic Command-Line Analysis' column to enable/disable heuristic command line analysis for each application.

Use the switch in the 'Embedded Code Detection' column to enable/disable embedded code detection for each application.

Select an application and click the edit button to update its details.

Select an application and click the trash can icon to remove it from the list.

Add a Exclusion

Click Script Analysis > RAutoruns scans > Exclusions
Select a application which you need to add an exclusions
Click 'Add' ,Enter an regex and click 'Ok' to save your changes

To delete the added regex click the delete icon, the selected regular expression will be removed

Add a new application

Click 'Add' at the top to include a new application to the list.

Enter the name of the application in the 'Add Application' dialog and click 'Add'

The new application will be added to the list and will be selected by default. You can use the toggle switch beside it to enable/disable it at any time.

Repeat the process to add more applications

To reset the list to the default list of applications, click 'Reset to Default' on the top

Click 'OK' to apply your changes.

Endpoint Manager

Endpoint Manager Administrator Guide 7.2

English

Script Analysis Settings