Renaming the cb.exe process

Products

• Carbon Black EDR

Issue/Introduction

Renaming cb.exe to any custom process name for environments that require it.

Environment

• Carbon Black EDR Sensor: Version 7.x and Higher
• Microsoft Windows: All supported versions

Resolution

1. Update the Sensor Group setting inside of the EDR web interface to a custom exe name (<custom>.exe). The default process name is listed as "cb.exe." 
2. After the setting is changed, install the new installer package from that Sensor group on a Windows endpoint
3. The cb.exe file is placed in the application folder. (C:\Windows\CarbonBlack by default)
4. The EDR sensor creates a copy of cb.exe and names it <custom>.exe
5. There are now (2) copies of the file on the endpoint: cb.exe and <custom>.exe, in the same directory.
6. cb.exe makes a call to services.exe to update its registry keys to reflect the new name (<custom>.exe)
7. The older cb.exe is deleted automatically.