Execution Prevention

Use application control/allowlisting to restrict PowerShell hosts, script paths, interpreters, and child-process behavior to approved engineering and operational workflows. Prefer explicit allowlists over broad blocking on production OT systems.

Restrict cmd.exe, batch files, and command-shell child processes to approved binaries, paths, parent processes, accounts, and maintenance workflows on Windows-based ICS assets. Preserve documented vendor and engineering dependencies.

Restrict interactive and scripted shell execution on Linux, network, and embedded ICS assets to approved accounts, management paths, commands, and vendor workflows. Where full application control is unavailable, constrain SSH/Telnet access and privileged shell use to dedicated administration paths.

Use application control and macro/script restrictions to prevent unapproved VBS/VBA/VBScript execution, while explicitly allowlisting required vendor macros and engineering automation.

Restrict Python execution to approved interpreters, scripts, libraries, accounts, and paths. On engineering systems where Python is required, use positive allowlisting rather than disabling the interpreter.

Use application control to restrict wscript.exe, cscript.exe, mshta.exe, Node.js, and other JavaScript runtimes to approved paths, parent processes, scripts, and users.