Script score

The Aurora Protect Desktop agent (version 3.2 and newer) supports enhanced script control using script scoring for Active Script and PowerShell scripts. Scripts that have an unsafe or abnormal script score can be blocked from running and alerted to the management console according to the device policy.

This table describes the script score statuses that appear on the Protection > Script Control page.

Status

Description

Unscored

This status displays if Endpoint Defense Cloud services could not score a script due to one of these reasons:

  • The device is not connected to the Internet.
  • The device is prevented from connecting to Endpoint Defense Cloud services.
  • The script event does not have an associated file that can be scored.
  • The script is novel — for example, it is new, custom-developed, or recently modified — and has not yet been classified by third-party intelligence sources or manual classification.

Not detected

This status displays whenEndpoint Defense Cloud has scored the script and determined it is not suspicious or malicious. A script must be fully evaluated by the cloud scoring service for this status to appear. Scripts that have not yet been scored, or for which scoring could not complete, show as Unscored instead.

Abnormal

This status displays if Endpoint Defense Cloud classifies the script as somewhat suspicious and potentially malicious.

Unsafe

This status displays if Endpoint Defense Cloud classifies the script as considerably suspicious or definitely malicious.

How script scoring works

Script scoring determines whether an existing classification is available for the script. Classifications become available through these mechanisms:

  • Third-party intelligence sources
  • Manual classification performed by a security analyst

Because the number of possible scripts is effectively unlimited, novel scripts — those that are new, custom-developed, or recently modified — may not match an existing classification and are reported as Unscored.

What to expect

A high percentage of Unscored scripts is expected in most environments and does not, by itself, indicate a product issue. Interpret Unscored as “no classification available,” not as a safe or unsafe verdict.

Enforcement mode behavior

In Block Unsafe Scripts and Block Abnormal and Unsafe Scripts enforcement modes, Unscored scripts are reported to the management console but allowed to run. Only scripts that have received a classification matching the configured enforcement threshold are blocked.

Script scoring should be viewed as a supplemental security control rather than a primary prevention mechanism. For the strongest Script Control posture:

  1. Begin in Alert mode to observe script activity.
  2. Identify trusted business scripts and create narrowly scoped exclusions.
  3. Move to Block mode with exclusions for allowed scripts.

Scoring-based enforcement modes (Block Unsafe Scripts and Block Abnormal and Unsafe Scripts) remain useful when full Block mode is operationally too restrictive, but they should be understood as a middle ground between security and usability rather than comprehensive protection against novel scripts.

This guidance reflects current scoring capabilities.