CBC: Why is a powershell.exe event missing an "invoked" argument in the cmdline?

Products

• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

Why is a powershell.exe event missing an "invoked" argument in the cmdline as below (for running the "hostname" command)

The application C:\windows\system32\windowspowershell\v1.0\powershell.exe invoked the application C:\windows\system32\hostname.exe.

 

Environment

• CBC Sensor: All versions
• CBC Console: All versions:
• Windows: All versions

Resolution

If powershell is launched from a taskbar, it will appear as an event without the usual "invoked {some command here}.