CB Protection: Why do Powershell reads show up as executions?
book
Article ID: 289393
calendar_today
Updated On:
Products
Carbon Black App Control (formerly Cb Protection)
Issue/Introduction
Why does it look like powershell is executing powershell scripts even when it's just reading the scripts?
Environment
CB Protection: All Supported Versions
Resolution
This happens because when a script processor loads a script even for reading it always shows up as an execution even if powershell.exe isn't running the instructions in the script.