Pleace replace the group of executables with the rule which is the same as that of “Defense Wall HIPS”.
CIS auto sandbox can block the following malwares by adding this rule.
the .bat script malware that deletes all files or hides all files
the malware that infects all executable files or all script files
[attachment deleted by admin]