Just Published! Threat Report: Exposing Malware in Linux-Based Multi-Cloud Environments | Download Now

Carbon Black Cloud: Why is the "process name" is sometimes the process calling a script, and sometimes it's the script (file) name?

Carbon Black Cloud: Why is the "process name" is sometimes the process calling a script, and sometimes it's the script (file) name?

Environment

  • Carbon Black Cloud Console: All versions
  • Enterprise EDR Console: All versions

Question

In the Carbon Black Cloud / Enterprise/EDR Console, why do some pages show the "process name" as the process calling a script?
Examples can be "powershell.exe" or  "msiexec.exe". In contrast, other pages will show the "process name" as the script or file name that's being called such as "my_script.ps1" or "my_install.msi" respectively.

Answer

  • The changing of the process name of the calling process for the script/file being called is referred to as "script host replacement". The process analysis page (bases on Enterprise EDR thread) will not show the replaced script, but rather the calling process (like powershell.exe).
  • Endpoint Standard-based Alert Triage page will usually perform script host replacement and display the script/file name (like myscript.ps1). This is also true for the V6 Alerts API.

Related Content


Was this article helpful? Yes No
No ratings
Article Information
Author:
Creation Date:
‎10-29-2021
Views:
273
Contributors