Carbon Black Cloud: Why Are Common Files Showing As Scripts?

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)
• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

Why are common files, such as .docx or .xlsx, showing as a script within Alert or Event data?

Environment

• Carbon Black Cloud Console: All Versions

Resolution

• This classification allows the Carbon Black Cloud sensor to track the files as Excel or Word files are not executable files.
• So when Office applications open .docx or .xlsx files, the sensor reports the activity as script interpreters, which is an executable that opens other files for read and performs operations based on the contents of the files.