Carbon Black Cloud: Process identified as script instead of the actual process name

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)

Issue/Introduction

Process, such as .docx, is being identified as a script instead of the actual process name

Environment

• Carbon Black Cloud Console: All Versions
• Endpoint Standard (formerly CB Defense): Version 3.3.x.x and Higher 
• Microsoft Windows: All supported versions

Cause

Endpoint Standard by design denotes the process as a script in order to get the exact reputation on its own rather than getting the reputation of a script interpreter host.

Resolution

This is by the design of the Endpoint Standard  and is expected behavior.

Additional Information

• Work is being done to include the script's name in a new search field called process_loaded_script_name. See https://community.carbonblack.com/t5/Idea-Central/CB-Defense-Script-Host-Event-Details/idi-p/87522
• Data files are treated similarly to scripts in the Endpoint Standard 
• The Endpoint Standard renames a script host to the script name once the script host opens the file. This will give more insight into the script (test123.docx) rather than the script host (winword.exe)

The script \\<EndpointName>\vmc-yoda\folders\<Username>\desktop\test123.docx established a TCP/443 connection to X.X.X.X:443 (self.events.data.microsoft.com, located in Amsterdam 07, Netherlands) from X.X.X.X:51078. 
The device was off the corporate network using the public address X.X.X.X (<EndpointName>, located in <City> OR, United States). The operation was successful.