Automated interpreted application control for workloads
Embodiments provide functionality to protect computing workloads from script-based attacks. Upon receipt, at a workload, of a command to commence execution of code of a script, an embodiment determines whether (i) permissions of a user issuing the command comply with a permissions security standard, (ii) an identifier of an interpreter supporting the script is included in an approved interpreter list, (iii) an identifier of a selected parameter of the interpreter is included in an approved parameter list, and (iv) an identifier of the script is included in an approved list of executables. If all of the aforementioned checks pass, such an embodiment allows execution of the code of the script; otherwise, execution is denied, thereby protecting the workload in an event of a script-based attack.
1. A computer-implemented method of protecting a computing workload from script-based attacks, the method comprising:
receiving, at a workload, a command to commence execution of code of a script;
determining whether:
(i) permissions of a user issuing the command comply with a permissions security standard;
(ii) an identifier of an interpreter supporting the script is included in an approved interpreter list;
(iii) an identifier of a selected parameter of the interpreter is included in an approved parameter list, wherein the selected parameter modifies operations performed by the interpreter and the identifier of the selected parameter is distinct from the identifier of the interpreter; and
(iv) an identifier of the script is included in an approved list of executables; and
allowing or denying the execution of the code of the script based on the determining, thereby protecting the workload from script-based attacks.
2. The method of claim 1 wherein at least one of the identifier of the interpreter, the identifier of the selected parameter, and the identifier of the script, includes a checksum.
3. The method of claim 1 further comprising:
receiving an identifier of an approved interpreter, or parameter thereof, from a vendor of the approved interpreter; and
adding the identifier of the approved interpreter, or parameter thereof, to the approved interpreter list, or the approved parameter list.
4. The method of claim 1 further comprising:
receiving an identifier of an approved script from a vendor of the approved script; and
adding the identifier of the approved script to the approved list of executables.
5. The method of claim 1 wherein allowing or denying the execution of the code of the script further comprises:
denying the execution of the code of the script in response to the received command not being present in a list of commands known to be used by the workload at runtime.
6. The method of claim 1 wherein allowing or denying the execution of the code of the script is further based on determining whether the user is positively authorized to execute the script based on permissions of the user and permissions of the script.
7. The method of claim 1 wherein allowing or denying the execution of the code of the script further comprises:
denying the execution of the code of the script in response to a process to be spawned by the script matching a process in a list of known malicious processes.
8. The method of claim 1 wherein allowing or denying the execution of the code of the script further comprises:
denying the execution of the code of the script in response to at least one of the script, a process to be spawned by the script and a library to be loaded during the execution of the script, including a known vulnerability.
9. The method of claim 1 further comprising, in response to allowing the execution of the code of the script:
intercepting a given process spawned during the execution of the code of the script;
tokenizing the received command;
comparing tokens of the tokenized received command with entries in an allow-list database; and
based on the comparing, maintaining the execution, or suspending the execution, of the code of the script, or indicating a result of the comparing to a user seeking to control execution of the script.
10. The method of claim 1 further comprising, in response to allowing the execution of the code of the script:
intercepting a library loaded during the execution of the script; and
in response to the library including a known vulnerability, and a disposition of the library regarding the vulnerability having not been received from a user, suspending the execution of the code of the script, or indicating the vulnerability to a user seeking to control execution of the script.
11. A system for protecting a computing workload from script-based attacks, the system comprising:
an application control policy (ACP) engine and an endpoint process monitoring client (EPMC); wherein
the EPMC is configured to intercept a command to commence execution of code of a script at a workload;
the ACP engine is configured to determine, in response to the interception of the command by the EPMC, whether:
(i) permissions of a user issuing the command comply with a permissions security standard;
(ii) an identifier of an interpreter supporting the script is included in an approved interpreter list;
(iii) an identifier of a selected parameter of the interpreter is included in an approved parameter list, wherein the selected parameter modifies operations performed by the interpreter and the identifier of the selected parameter is distinct from the identifier of the interpreter; and
(iv) an identifier of the script is included in an approved list of executables; and
the ACP engine is configured to allow or deny the execution of the code of the script based on the determining, thereby protecting the workload from script-based attacks.
12. The system of claim 11 wherein at least one of the identifier of the interpreter, the identifier of the selected parameter, and the identifier of the script, includes a checksum.
13. The system of claim 11 wherein at least one of the EPMC and the APC engine, is further configured to:
receive an identifier of an approved interpreter, or parameter thereof, from a vendor of the approved interpreter; and
add the identifier of the approved interpreter, or parameter thereof, to the approved interpreter list, or the approved parameter list.
14. The system of claim 11 wherein at least one of the EPMC and the APC engine, is further configured to:
receive an identifier of an approved script from a vendor of the approved script; and
add the identifier of the approved script to the approved list of executables.
15. The system of claim 11 wherein allowing or denying execution of the code of the script includes:
denying the execution of the code of the script in response to the intercepted command not being present in a list of commands known to be used by the workload at runtime.
16. The system of claim 11 wherein allowing or denying execution of the code of the script includes:
denying the execution of the code of the script in response to a process to be spawned by the script matching a process in a list of known malicious processes.
17. The system of claim 11 wherein allowing or denying execution of the code of the script includes:
denying the execution of the code of the script in response to at least one of the script, a process to be spawned by the script, and a library to be loaded during the execution of the script, including a known vulnerability.
18. The system of claim 11 wherein:
the EPMC, in response to the execution of the code of the script, is configured to intercept a given process spawned during the execution of the code of the script; and
the ACP engine is configured to:
(i) tokenize the received command;
(ii) compare tokens of the tokenized received command with entries in an allow-list database; and
(iii) based on the comparing, maintain the execution, or suspend the execution, of the code of the script, or indicate a result of the comparing to a user seeking to control execution of the script.
19. The system of claim 11 wherein:
the EPMC, in response to allowing the execution of the code of the script, is configured to intercept a library loaded during the execution of the script; and
the ACP engine, in response to (i) the library including a known vulnerability, and (ii) a disposition of the library regarding the vulnerability having not been received from a user, is configured to suspend the execution of the code of the script, or to indicate the vulnerability to a user seeking to control execution of the script.
20. A computer program product for protecting a computing workload from script-based attacks, the computer program product comprising:
one or more non-transitory computer-readable storage devices and program instructions stored on at least one of the one or more storage devices, the program instructions, when loaded and executed by a processor, cause the processor to:
receive, at a workload, a command to commence execution of code of a script;
determine whether:
(i) permissions of a user issuing the command comply with a permissions security standard;
(ii) an identifier of an interpreter supporting the script is included in an approved interpreter list;
(iii) a selected parameter of the interpreter is included in an approved parameter list, wherein the selected parameter modifies operations performed by the interpreter and the identifier of the selected parameter is distinct from the identifier of the interpreter; and
(iv) an identifier of the script is included in an approved list of executables; and
allow or deny the execution of the code of the script based on the determining, thereby protecting the workload from script-based attacks.