EDR: Powershell Failures When Running the 7.1 Sensor

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

Installing powershell modules fails when the EDR sensor is installed

Environment

• EDR Windows Sensor: 7.1

Cause

There are some conflicts between the new AMSI features in the sensor. This is issue CB-33118.

Resolution

Upgrade to the 7.2.x sensor or Higher as it includes fixes for AMSI

Additional Information

"Fileless script loads" can also be disabled on the sensor group as a workaround