Just Published! Threat Report: Exposing Malware in Linux-Based Multi-Cloud Environments | Download Now

Carbon Black Cloud: Why Do Some Powershell Events Show the .ps1 Script as the Process Name?

Carbon Black Cloud: Why Do Some Powershell Events Show the .ps1 Script as the Process Name?

Environment

  • Carbon Black Cloud Sensor: 3x
  • Microsoft Windows:  All Versions

Question

Why do some events in the Carbon Black console show PowerShell.exe as the process, and other events show the .ps1 script name as the process?

Answer

If both the Enterprise EDR (formerly known as Threat Hunter) and the Endpoint Standard (formerly known as Defense) features are enabled, this can/will occur.

The Endpoint Standard component of the sensor is designed to present the script name as the process when PowerShell runs a .ps1 file, in order to make it easier for a security analyst to see the behavior without drilling down into the event.

The Enterprise EDR (EEDR) component of the sensor does not perform the name replacement of the process like Endpoint Standard does. 

Additional Notes

As a workaround, add the following search term to the watchlist IOC/search to only show or not show the enhanced data:

Enhanced:true -- only show the events that have the PowerShell script name as the process
Enhanced:false -- only show the events that show PowerShell as the process.
 

Related Content


Was this article helpful? Yes No
No ratings
Article Information
Author:
Creation Date:
‎01-05-2022
Views:
270
Contributors