Blog Viewer

Carbon Black Cloud: Why Are Common Files Showing As Scripts?

By CB_Support posted Mar 13, 2024 03:24 PM

  

Environment

  • Carbon Black Cloud Console: All Versions

Question

Why are common files, such as .docx or .xlsx, showing as a script within Alert or Event data?

Answer

  • This classification allows the Carbon Black Cloud sensor to track the files as Excel or Word files are not executable files.
  • So when Office applications open .docx or .xlsx files, the sensor reports the activity as script interpreters, which is an executable that opens other files for read and performs operations based on the contents of the files.


#EndpointStandard
#Workload
#AuditandRemediation
#ManagedDetectionandResponse
#ManagedDetection
#CarbonBlackCloud
#EnterpriseEDR
#Container
#Prevention
0 comments
0 views

Permalink