Endpoint Standard: How was task manager launched?

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)

Issue/Introduction

To determine how taskmanager was launched from alert triage.

Environment

• Carbon Black Cloud Console: All versions
• Microsoft Windows: All Supported Versions

Resolution

• Usually in the following format where 'x' is a numeric value:

  taskmgr.exe /x

Additional Information

• Task manager can be launched in many ways, each one has a different entry in the console events. 
• Information on the numeric values can be found in the linked blog post, be aware that this is not an official VmWare blog so may not be 100% accurate and is subject to change.