Systems and methods for blocking malicious script execution

1. A method for blocking malicious script execution, the method comprising:

detecting an execution of a first script that creates or modifies a file on a computing device;

recording, in a database, a first report comprising a first list of operations involved in the execution of the first script, an identifier of the first script, and an identifier of the file;

determining that the file includes malicious code using a malware scanner configured to scan for malware signatures on the computing device;

recording, in the database, a second report comprising an indication that the file includes malicious code and an identifier of the file;

in response to determining that identifier of the file is present in both the first report and the second report, generating a first rule that prevents execution of any script that shares at least one operation in the first list of operations with the first script; and

blocking, based on the first rule, complete execution of scripts that involve at least one operation in the first list of operations on the computing device.

2. The method of claim 1 , wherein blocking the complete execution of scripts comprises:

detecting an execution of a second script on the computing device;

determining a second list of operations involved in the execution of the second script;

applying the first rule on the second list of operations by:

comparing the first list of operations with the second list of operations;

determining, based on the comparing, that the first list of operations corresponds to the second list of operations; and

blocking the execution of the second script from completion.

3. The method of claim 1 , further comprising:

prior to the execution of the first script, determining whether a rule exists in a rules database indicating that the first script should be blocked; and

enabling execution of the first script in response to determining that the rule does not exist in the rules database.

4. The method of claim 1 , wherein the first report includes timestamps of operations and the second report includes a timestamp of when the file was created or modified, further comprising:

determining a time period associated with the timestamps of the list of operations; and

determining that the first report should be compared to the second report in response to determining that the timestamp of when the file was created or modified occurs within the time period.

5. The method of claim 1 , wherein the first rule further comprises a modified version of the first list of operations to block.

6. The method of claim 5 , further comprising:

determining the modified version of the list of operations by converting each operation identifier in the list of operations to a regular expression.

7. The method of claim 1 , further comprising:

converting the first rule from a text format to a binary format; and

storing the converted first rule in a rules database.

8. The method of claim 1 , wherein the execution of the first script creates or modifies a plurality of files including the file and another file, wherein the another file is identified as including malicious code by the malware scanner, and wherein generating the first rule is further in response to detecting either an identifier of the another file or the identifier of the file in both the first report and the second report.

9. The method of claim 1 , wherein the first script is a PHP script.

10. A system for blocking malicious script execution, the system comprising:

a hardware processor configured to:

detect an execution of a first script that creates or modifies a file on a computing device;

record, in a database, a first report comprising a first list of operations involved in the execution of the first script, an identifier of the first script, and an identifier of the file;

determine that the file includes malicious code using a malware scanner configured to scan for malware signatures on the computing device;

record, in the database, a second report comprising an indication that the file includes malicious code and an identifier of the file;

in response to determining that identifier of the file is present in both the first report and the second report, generate a first rule that prevents execution of any script that shares at least one operation in the first list of operations with the first script; and

block, based on the first rule, complete execution of scripts that involve at least one operation in the first list of operations on the computing device.

11. The system of claim 10 , wherein the hardware processor is further configured to block the complete execution of scripts by:

detecting an execution of a second script on the computing device;

determining a second list of operations involved in the execution of the second script;

applying the first rule on the second list of operations by:

comparing the first list of operations with the second list of operations;

determining, based on the comparing, that the first list of operations corresponds to the second list of operations; and

blocking the execution of the second script from completion.

12. The system of claim 10 , wherein the hardware processor is further configured to:

prior to the execution of the first script, determine whether a rule exists in a rules database indicating that the first script should be blocked; and

enable execution of the first script in response to determining that the rule does not exist in the rules database.

13. The system of claim 10 , wherein the first report includes timestamps of operations and the second report includes a timestamp of when the file was created or modified, wherein the hardware processor is further configured to:

determine a time period associated with the timestamps of the list of operations; and

determine that the first report should be compared to the second report in response to determining that the timestamp of when the file was created or modified occurs within the time period.

14. The system of claim 10 , wherein the first rule further comprises a modified version of the list of operations to block.

15. The system of claim 14 , wherein the hardware processor is further configured to:

determine the modified version of the list of operations by converting each operation identifier in the list of operations to a regular expression.

16. The system of claim 10 , wherein the hardware processor is further configured to:

convert the first rule from a text format to a binary format; and

store the converted first rule in a rules database.

17. The system of claim 10 , wherein the execution of the first script creates or modifies a plurality of files including the file and another file, wherein the another file is identified as including malicious code by the malware scanner, and wherein the hardware processor is further configured to generate the first rule further in response to detecting either an identifier of the another file or the identifier of the file in both the first report and the second report.

18. The system of claim 10 , wherein the first script is a PHP script.

19. A non-transitory computer readable medium storing thereon computer executable instructions for blocking malicious script execution, including instructions for:

detecting an execution of a first script that creates or modifies a file on a computing device;

recording, in a database, a first report comprising a first list of operations involved in the execution of the first script, an identifier of the first script, and an identifier of the file;

determining that the file includes malicious code using a malware scanner configured to scan for malware signatures on the computing device;

recording, in the database, a second report comprising an indication that the file includes malicious code and an identifier of the file;

in response to determining that identifier of the file is present in both the first report and the second report, generating a first rule that prevents execution of any script that shares at least one operation in the first list of operations with the first script; and

blocking, based on the first rule, complete execution of scripts that involve at least one operation in the first list of operations on the computing device.

20. The non-transitory computer readable medium of claim 19 , wherein instructions for blocking the complete execution of scripts comprise instructions for:

detecting an execution of a second script on the computing device;

determining a second list of operations involved in the execution of the second script;

applying the first rule on the second list of operations by:

comparing the first list of operations with the second list of operations;

determining, based on the comparing, that the first list of operations corresponds to the second list of operations; and

blocking the execution of the second script from completion.