EDR: Why Does CbEDRAMSI Load into Processes After CB Sensor has Stopped?

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

If the sensor service stopped, why does CbEDRAMSI.dll continue to load into processes?

Environment

EDR Server:  7.6.x+
EDR Windows Sensor: 7.2+

Resolution

If AMSI event collection is enabled, then the DLL is registered with the OS to be loaded into any AMSI capable process.  To stop this from happening, unselect 'Fileless script loads' in Sensor > Groups > Settings > Event Collection and allow the sensor check-in to retrieve the updated configuration.