Jump to content

HIPS allow rules, possible to allow a particular script to be ran?


PuterCare

Recommended Posts

I have the HIPS rules enabled, but they are blocking some scripts from running. I have a script that auto-updates some applications:

C:\Windows\system32\wscript.exe "C:\ProgramData\Winget-AutoUpdate\Invisible.vbs" "powershell.exe -NoProfile -ExecutionPolicy Bypass -File """C:\ProgramData\Winget-AutoUpdate\user-run.ps1""

When it is ran, it is blocked:

01/12/2023 11:01:36;C:\Windows\explorer.exe;Start new application;C:\Windows\system32\wscript.exe;Blocked;Deny script processes started by explorer;

I'd rather not turn this rule off as in most instances, we do not want to let explorer start wscript etc. I have tried adding a rule but they seem to be so broad that I can allow one process to launch another, but I can't seem to be any more specific than that. 

Is there any way around this other than turning the rule off?

Thanks

Link to comment
Share on other sites

1 minute ago, Marcos said:

You can copy wscript.exe to a location that is not in the path variable and run the script with a full path to that wscript.exe.

Thanks, I will give that a try. 

Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.
Note: Your post will require moderator approval before it will be visible.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

  • Recently Browsing   0 members

    • No registered users viewing this page.
×
×
  • Create New...