The article explains that operational scripts on customer endpoints should be governed like production software, whether they are cloned, hand-written, or AI-generated. It highlights two scaling models—template reuse and AI-assisted authoring—showing that Acronis built-in scripts are heavily cloned while AI-generated scripts are increasingly common in some markets, requiring different governance controls for each. #Acronis #NISTSP800-53 #CISControlsv8 #OWASP #ENISA
Keypoints
- Scripts run with administrator-level privileges and should be managed with production-grade lifecycle discipline, including review, versioning, attribution, and retirement.
- The article identifies two scaling strategies: cloning trusted templates and generating new scripts with AI.
- About 38.9% of active scripts are clones of existing sources, and six Acronis built-in scripts account for about 32.5% of all clone copies.
- About 15.6% of active scripts are AI-generated, and roughly 13.9% of classified script-using tenants are AI-heavy.
- AI-heavy tenants clone less, suggesting AI generation substitutes for cloning rather than adding on top of it.
- Regional behavior varies: some markets are AI-origination markets, others are AI-augmentation markets, and others remain cloning-dominant.
- The recommended controls differ by strategy: source curation for cloning-heavy environments and output verification for AI-heavy environments.
MITRE Techniques
- [T1036 ] Masquerading – Scripts and templates can be reused or altered in ways that make malicious or unreviewed code appear trusted or standard, as emphasized by the need for source curation and review (‘review, attribution, versioning and retirement’).
- [T1059 ] Command and Scripting Interpreter – The article centers on operational scripts executed on endpoints, including PowerShell and shell scripts run with elevated privileges (‘Every script you run on a customer endpoint is operational software with administrator privileges.’)
- [T1068 ] Exploitation for Privilege Escalation – Scripts launched with administrative credentials can read files, change settings, install/remove software, or persist footholds, effectively enabling high-impact actions (‘enough to read any file, change any setting, install or remove software or persist a foothold’).
- [T1204 ] User Execution – Scripts are run by technicians or users and therefore depend on execution decisions made by people (‘Every script you run on a customer endpoint is operational software’).
- [T1552 ] Unsecured Credentials – The article notes that cloned scripts carry credentials in some tenants, meaning secrets may be embedded in scripts (‘every one of the six carries credentials in at least some of the tenants that cloned it’).
- [T1601 ] Modify System Image – Operational scripts are described as being able to install or remove software and change system settings, which can alter the endpoint environment (‘change any setting, install or remove software’).
- [T1574 ] Hijack Execution Flow – The discussion of scripts persisting a foothold and being trusted-by-default aligns with abuse of execution paths on managed endpoints (‘or persist a foothold’).
Indicators of Compromise
- [Script/template names ] Acronis built-in platform-catalog scripts referenced as heavily cloned sources – six built-in scripts, the single most-replicated source
- [File type / script language ] Operational scripts used across tenants – Windows PowerShell templates, shell scripts
- [Policy/control references ] Governance and review context – NIST SP 800-53 Rev. 5, CIS Critical Security Controls v8, NIST AI RMF 1.0, ENISA Multilayer Framework, OWASP secure-coding guidance
Read more: https://www.acronis.com/en/tru/posts/two-ways-to-scale-your-scripts/