Site Recovery Manager customizes a IP Customization script, based on the VM's operating system and administrated IP configuration in the Recovery Plan, to be uploaded and executed on the target virtual machine to change the IP stack according to the administrator's wishes. The same transport happens when also running call out scripts provided by the administrator in the Recovery Plan.
This transport goes from the Site Recovery Manager server/appliance to the host running the virtual machine, and from there directly into the virtual machine through VMware Tools, which are required for this function to work.
From there, there are a number of things that happen, logging files being created, vgauth logs, and the script that is ran to change the IP Stack per the Guest OS specifications.
Carbon Black may flag these as it sees it as a script execution inside the Guest OS. Some work may need to be done to allow this execution on the Guest OS.