EDR: Are the MD5s of scripts run by powershell and wscript captured?
search cancel

EDR: Are the MD5s of scripts run by powershell and wscript captured?

book

Article ID: 289958

calendar_today

Updated On:

Products

Carbon Black EDR (formerly Cb Response)

Issue/Introduction

Does the EDR sensor collect MD5 data of fileless script attacks executed through services like Wscript and Powershell?

Environment

  • EDR Server: All versions (Formerly CB Response)
  • EDR Sensor: 7.1 and lower
  • Microsoft Windows: All supported versions

Resolution

No. Future sensor versions will have better visibility into command line executions