Reply to thread

Message

<blockquote data-quote="danb" data-source="post: 1081941" data-attributes="member: 62850">Actually, if you can parse the command line and also determine the primary parent process, there are some really cool things you can do, so that you do not have to block these file types globally, and you can allow what needs to be allowed, whether the script is in the user or system space.I can go in to further detail at some point, but here is a quick overview.When I run a .bat script from my desktop, here is the command line: c:\windows\system32\cxd.exe /c &quot;&quot;c:\users\user\desktop\test.bat&quot; &quot; (the cxd is actually cmd, but I could not post that.)The way CyberLock has always worked in this scenario (well, for at least 10 years), is that it parses the command line and &quot;c:\users\user\desktop\test.bat&quot; becomes the executable path, and from that path is where it determines whether it should block it or not... for example, if it has already been allowed / is whitelisted, then the file will allowed, otherwise it will be blocked.&nbsp; This is overly simplified explanation, but you get the point.&nbsp; But ultimately, instead of simply blocking globally by file type, CyberLock figures out the path of the script / file, then either blocks or allows it after it is evaluated by many different checks.The new File Type feature works pretty much the same way, and it also made it super easy to add or remove file types / extensions from the list.</blockquote>

[QUOTE="danb, post: 1081941, member: 62850"] Actually, if you can parse the command line and also determine the primary parent process, there are some really cool things you can do, so that you do not have to block these file types globally, and you can allow what needs to be allowed, whether the script is in the user or system space. I can go in to further detail at some point, but here is a quick overview. When I run a .bat script from my desktop, here is the command line: c:\windows\system32\cxd.exe /c ""c:\users\user\desktop\test.bat" " (the cxd is actually cmd, but I could not post that.) The way CyberLock has always worked in this scenario (well, for at least 10 years), is that it parses the command line and "c:\users\user\desktop\test.bat" becomes the executable path, and from that path is where it determines whether it should block it or not... for example, if it has already been allowed / is whitelisted, then the file will allowed, otherwise it will be blocked. This is overly simplified explanation, but you get the point. But ultimately, instead of simply blocking globally by file type, CyberLock figures out the path of the script / file, then either blocks or allows it after it is evaluated by many different checks. The new File Type feature works pretty much the same way, and it also made it super easy to add or remove file types / extensions from the list. [/QUOTE]

Verification