Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 1 reply
  • Subscribers 14 subscribers
  • Views 1099 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Blocking of Custom File type for execution

Shashank Khamkar

Dear Team,

Can we Block Batch file execution or Command Prompt through Sophos Endpoint Protection?

If yes then Kindly provide a KB article.



This thread was automatically locked due to age.
Parents
  • 0

    Hi Shashank,

    Thanks for reaching out to the Sophos Community Forum. 

    It is not currently possible to block batch file execution, though you will remain protected from malicious batch files. With the behaviour-based scanning from Intercept X, if a batch file begins disabling key security features or downloads malware from known malicious sites, the processes will be stopped.

    Command Prompt is not currently listed as a controlled application, it is not possible to block CMD through Sophos Endpoint. With that being said, the same behaviour-based scanning will still be in place; should malicious commands or operations be triggered via CMD, they will be blocked as well.

    I was able to locate a GPO which will allow you to block CMD specifically:

    1. Open Start.
    2. Search for gpedit.msc and select the top result to open the Local Group Policy Editor.
    3. Browse the following path:User Configuration > Administrative Templates > System
    4. On the right side, double-click the Prevent access to the command prompt policy.
    Kushal Lakhan
    Team Lead, Global Community Support
    Connect with Sophos Support, get alerted, and be informed.
    If a post solves your question, please use the "Verify Answer" button.
    The New Home of Sophos Support Videos!  - Visit Sophos Techvids
Reply
  • 0

    Hi Shashank,

    Thanks for reaching out to the Sophos Community Forum. 

    It is not currently possible to block batch file execution, though you will remain protected from malicious batch files. With the behaviour-based scanning from Intercept X, if a batch file begins disabling key security features or downloads malware from known malicious sites, the processes will be stopped.

    Command Prompt is not currently listed as a controlled application, it is not possible to block CMD through Sophos Endpoint. With that being said, the same behaviour-based scanning will still be in place; should malicious commands or operations be triggered via CMD, they will be blocked as well.

    I was able to locate a GPO which will allow you to block CMD specifically:

    1. Open Start.
    2. Search for gpedit.msc and select the top result to open the Local Group Policy Editor.
    3. Browse the following path:User Configuration > Administrative Templates > System
    4. On the right side, double-click the Prevent access to the command prompt policy.
    Kushal Lakhan
    Team Lead, Global Community Support
    Connect with Sophos Support, get alerted, and be informed.
    If a post solves your question, please use the "Verify Answer" button.
    The New Home of Sophos Support Videos!  - Visit Sophos Techvids
Children
No Data
Unfiltered HTML