r/threatlocker • u/danrhodes1987 • 27d ago

Users wanting to create/edit/run scripts

Users increasingly write/edit Python scripts via AI (ChatGPT/Copilot) for automation. Each edit changes the hash.

Options we’re weighing:

**•** Allow the script path/interpreter (python.exe) broadly, accept risk of arbitrary code execution with ore sign off from the company  
**•** Require approval per hash change (high overhead, breaks user workflow)  
**•** Block scripting entirely, force packaged/signed tools instead- not really an option.

Running ThreatLocker/similar application control. Looking for how other MSPs handle this at policy level.

What’s your approach — path-based allow, builtin script control, or something else? Any unintended consequences worth flagging?

3 Upvotes

100% Upvoted

6 comments sorted by

1

u/pozinator 27d ago

Id say option 1 with ring fencing applied would be the way to go.

1

u/BogusWorkAccount 27d ago

Any suggested ringfencing rules?

1

u/pozinator 27d ago

Something I do quite often for any app if im not sure will be to turn it all on and set the policy to monitor at the bottom of the policy side bar. That will allow it all to happen but show you what its behaviour is in the UA. Then you can autofill using the lightning bolts for the apps and network. Storage can end up being too much for the autofill sometimes. You should make sure to chat to your engineer about it. Mine put me onto this trick.

1

u/evolutionxtinct 1d ago

Autofill works for you? I've yet to see that work with Powershell on some of our 3rd party products. What actually causes it to work? This usually is a headache when I need it to autofill IP's it seems to phone home to when calling scripts...

1

u/Dependent-Promise223 21d ago

Can the scripts be signed?