Endpoint Standard: Sensor blocks VMware Workspace One Intelligent Hub

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)

Issue/Introduction

Alerts blocking 'vmware.intelligenthub.communicationservice.exe' as KNOWN_MALWARE or HEURISTIC

Environment

• VMware Carbon Black Cloud Sensor: All Versions
  • Endpoint Standard (formerly CB Defense)
• VMware Workspace One Intelligent Hub

Cause

False positive for 'vmware.intelligenthub.communicationservice.exe'  SHA256: 12b2c58a69bc8b02f11b4e5423c253b564e237f521302d4ed7ebede6547c4693

Resolution

Issue has been resolved, hash reputation updated to TRUSTED_WHITE_LIST

Additional Information

• Blocks for hash may have occurred between Jan. 2 and Jan. 13th 2021. 
• Workarounds:
  • Add file hash to company approved list
  • Create policy permission Allow and Log rule for **\VMware.IntelligentHub.CommunicationService.exe