Update: scripting definition file

[pmichaudrc]

Which category is the feature part of?

• [ ] Carbon Black Response
• [ ] Threat Hunter
• [x] Definition File
• [ ] Code Feature - impacts all products
• [ ] New product support

Use Cases

Proposal Update the contents of the scripting definition file

Additional context Add any other context or screenshots about the feature request here.

[rc-abodkins]

Updates from when this was worked on in August 2021.

{
    "AutoIt": { 
        "process_name": ["autoit.exe"]
    },
    "Powershell": { 
        "process_name": ["powershell*.exe", "pwsh.exe", "posh.exe", "runscripthelper.exe"]
    },
    "PSExec": { 
        "process_name": ["psexec*.exe",
                         "psexesvc.exe"]
    },
    "Windows Shell": { 
        "process_name": ["cmd.exe"]
    },
    "WScript": { 
        "process_name": ["wscript.exe"]
    },
    "CScript": { 
        "process_name": ["cscript.exe"]
    },
    "Jscript":{
        "process_name": ["jscript.exe"]
    }
    "Python": { 
        "process_name": ["python*.exe"]
    },
    "Perl": { 
        "process_name": ["perl*.exe"]
    },
    "PHP":{
        "process_name":["php.exe", "php-cgi.exe"]
    },
    "mshta": {
        "process_name": ["mshta.exe"]
    }, 
    "hh":{
        "process_name": ["hh.exe"]
    }, 
    "Diskshadow": {
        "process_name":["diskshadow.exe"]
    }, 
    "CSC": {
        "process_name":["csc.exe"]
    }, 
    "msbuild":{
        "process_name":["msbuild.exe"]
    }, 
    "GPscript.exe":{
        "process_name":["gpscript.exe"]
    }, 
    "Windows Subsystem for Linux":{
        "process_name":["bash.exe"]
    }
}