CB Protection: Why do Powershell reads show up as executions?
search cancel

CB Protection: Why do Powershell reads show up as executions?

book

Article ID: 289393

calendar_today

Updated On:

Products

Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

Why does it look like powershell is executing powershell scripts even when it's just reading the scripts? 

Environment

  • CB Protection: All Supported Versions

Resolution

  • This happens because when a script processor loads a script even for reading it always shows up as an execution even if powershell.exe isn't running the instructions in the script.