Supported interpreters and processes

The Endpoint Sensors component monitors the execution of scripts by the following interpreters:

• cmd.exe;
• reg.exe;
• regedit.exe;
• regedt32.exe;
• cscript.exe;
• wscript.exe;
• mmc.exe;
• msiexec.exe;
• mshta.exe;
• rundll32.exe;
• runlegacycplelevated.exe;
• control.exe;
• explorer.exe;
• regsvr32.exe;
• wwahost.exe;
• powershell.exe;
• java.exe and javaw.exe (only if started with the –jar option);
• InstallUtil.exe;
• msdt.exe;
• python.exe;
• ruby.exe;
• rubyw.exe.

Information about the processes monitored by the Endpoint Sensor component is presented in the table below.

Processes and the file extensions that they open

Process	File extensions
winword.exe	rtf doc dot docm docx dotx dotm docb
excel.exe	xls xlt xlm xlsx xlsm xltx xltm xlsb xla xlam xll xlw
powerpnt.exe	ppt pot pps pptx pptm potx potm ppam ppsx ppsm sldx sldm
acrord32.exe	pdf
wordpad.exe	docx pdf
chrome.exe	pdf
MicrosoftEdge.exe	pdf

See also Viewing the Endpoint Sensors table on a standalone Central Node server Viewing the Endpoint Sensors table on a standalone Central Node server with KSC integration Viewing the Endpoint Sensors table in distributed solution and multitenancy mode Viewing information about a host Filtering and searching Endpoint Sensors by host name Filtering and searching Endpoint Sensors that have been isolated from the network Filtering and searching Endpoint Sensors by PCN and SCN server names Filtering and searching Endpoint Sensors by computer IP address Filtering and searching Endpoint Sensors by operating system version on the computer Filtering and searching Endpoint Sensors based on the Endpoint Sensor component version Filtering and searching Endpoint Sensors based on their activity Filtering and searching Endpoint Sensors by operating errors of the component Quickly creating a filter for computers with the Endpoint Sensors component Clearing the Endpoint Sensors filter Configuring Endpoint Sensors activity indicators

Page top