Carbon Black Cloud: Process identified as script instead of the actual process name
book
Article ID: 290268
calendar_today
Updated On:
Products
Carbon Black Cloud Endpoint Standard (formerly Cb Defense)
Issue/Introduction
Process, such as .docx, is being identified as a script instead of the actual process name
Environment
Carbon Black Cloud Console: All Versions
Endpoint Standard (formerly CB Defense): Version 3.3.x.x and Higher
Microsoft Windows: All supported versions
Cause
Endpoint Standard by design denotes the process as a script in order to get the exact reputation on its own rather than getting the reputation of a script interpreter host.
Resolution
This is by the design of the Endpoint Standard and is expected behavior.
Additional Information
Work is being done to include the script's name in a new search field called process_loaded_script_name. See https://community.carbonblack.com/t5/Idea-Central/CB-Defense-Script-Host-Event-Details/idi-p/87522
Data files are treated similarly to scripts in the Endpoint Standard
The Endpoint Standard renames a script host to the script name once the script host opens the file. This will give more insight into the script (test123.docx) rather than the script host (winword.exe)
The script \\<EndpointName>\vmc-yoda\folders\<Username>\desktop\test123.docx established a TCP/443 connection to X.X.X.X:443 (self.events.data.microsoft.com, located in Amsterdam 07, Netherlands) from X.X.X.X:51078.
The device was off the corporate network using the public address X.X.X.X (<EndpointName>, located in <City> OR, United States). The operation was successful.