CIS-2.7 Allowlist Authorized Scripts

• T1037 Boot or Logon Initialization Scripts — Startup scripts not on the allowlist cannot execute, disrupting persistence. • T1059.001 PowerShell — Unauthorized PowerShell scripts fail execution under enforced script allowlisting. • T1059.002 AppleScript — Script allowlisting prevents execution of unauthorized AppleScript files under enforced script validation policies. • T1059.003 Windows Command Shell — Non-authorized batch or shell scripts are blocked. • T1059.004 Unix Shell — Unauthorized shell scripts fail execution when enforced through script hash/signature/path validation. • T1059.005 Visual Basic — Malicious VB scripts/macros are prevented if not allowlisted. • T1059.006 Python — Unauthorized Python scripts are blocked when interpreter policies enforce script validation. • T1059.007 JavaScript — Script enforcement blocks execution of non-authorized JavaScript files invoked via host interpreters. • T1137.001 Office Template Macros — Macro scripts blocked if script enforcement applies to macro execution policies. • T1216 System Script Proxy Execution — If script payload execution is enforced regardless of invoking binary, proxy-based script execution is reduced. • T1546.013 PowerShell Profile — PowerShell profile persistence relies on executing a script at interpreter startup. Script allowlisting prevents unauthorized profile scripts from executing.