Why is the "process name" is sometimes the process calling a script, and sometimes it's the script (file) name?

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)
• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

In the Carbon Black Cloud / Enterprise/EDR Console, why do some pages show the "process name" as the process calling a script?

Examples can be "powershell.exe" or  "msiexec.exe". In contrast, other pages will show the "process name" as the script or file name that's being called such as "my_script.ps1" or "my_install.msi" respectively.

Environment

• Carbon Black Cloud Console: All versions
• Enterprise EDR Console: All versions

Resolution

• The changing of the process name of the calling process for the script/file being called is referred to as "script host replacement". The process analysis page (bases on Enterprise EDR thread) will not show the replaced script, but rather the calling process (like powershell.exe).
• Endpoint Standard-based Alert Triage page will usually perform script host replacement and display the script/file name (like myscript.ps1). This is also true for the V6 Alerts API.