CBC: Why is a powershell.exe event missing an "invoked" argument in the cmdline?
book
Article ID: 288172
calendar_today
Updated On:
Products
Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)
Issue/Introduction
Why is a powershell.exe event missing an "invoked" argument in the cmdline as below (for running the "hostname" command)
The application C:\windows\system32\windowspowershell\v1.0\powershell.exe invoked the application C:\windows\system32\hostname.exe.
Environment
- CBC Sensor: All versions
- CBC Console: All versions:
- Windows: All versions
Resolution
If powershell is launched from a taskbar, it will appear as an event without the usual "invoked {some command here}.
Feedback
thumb_up
Yes
thumb_down
No