Systems and methods for blocking malicious script execution

A system for blocking malicious script execution, the system comprising:

• a hardware processor configured to:
• detect an execution of a first script that creates or modifies a file on a computing device;
• record, in a database, a first report comprising a first list of operations involved in the execution of the first script, an identifier of the first script, and an identifier of the file;
• determine that the file includes malicious code using a malware scanner configured to scan for malware signatures on the computing device;
• record, in the database, a second report comprising an indication that the file includes malicious code and an identifier of the file;
• in response to determining that identifier of the file is present in both the first report and the second report, generate a first rule that prevents execution of any script that shares at least one operation in the first list of operations with the first script;
• and
• block, based on the first rule, complete execution of scripts that involve at least one operation in the first list of operations on the computing device.

A non-transitory computer readable medium storing thereon computer executable instructions for blocking malicious script execution, including instructions for:

• detecting an execution of a first script that creates or modifies a file on a computing device;
• recording, in a database, a first report comprising a first list of operations involved in the execution of the first script, an identifier of the first script, and an identifier of the file;
• determining that the file includes malicious code using a malware scanner configured to scan for malware signatures on the computing device;
• recording, in the database, a second report comprising an indication that the file includes malicious code and an identifier of the file;
• in response to determining that identifier of the file is present in both the first report and the second report, generating a first rule that prevents execution of any script that shares at least one operation in the first list of operations with the first script;
• and
• blocking, based on the first rule, complete execution of scripts that involve at least one operation in the first list of operations on the computing device.