Enterprise EDR: Search excluding parent_name returns results including listed parent process ($$deleteme prefix)
book
Article ID: 285938
calendar_today
Updated On:
Products
Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)
Issue/Introduction
Reports like 'SANS Unusual <process_name> Parent Or Child' and 'SANS Unusual <process_name> Parent' return results for the parent_name which should be excluded
Example
SANS Unusual Csrss.Exe Parent Or Child
((process_name:csrss.exe parent_name:* -parent_name:smss.exe -parent_name:csrss.exe)) -(legacy:true OR enriched:true)
Search returns results that include parent_name:smss.exe and/or parent_name:csrss.exe
Adding either '$$deleteme.<parent_name>.*' or '*<parent_name>*' for each listed parent reduces false positive search results
Examples
(process_name:csrss.exe parent_name:* AND -(parent_name:*smss.exe* OR parent_name:*csrss.exe*)) -(legacy:true OR enriched:true)
(process_name:csrss.exe parent_name:* AND -(parent_name:smss.exe OR parent_name:csrss.exe OR parent_name:$$deleteme.smss.exe* OR parent_name:$$deleteme.csrss.exe*)) -(legacy:true OR enriched:true)
Parent was in the process of being deleted at the time of the event as part of Windows update transition, and therefore had a temporary or transitional name starting with $$deleteme and running from PendingDeletes folder
Resolution
Overall issue being tracked under DSER-32492 and TR-5635
-parent_name:*<ActualName>*
NOT parent_name:*<ActualName>*
-parent_name:$$deleteme.<ActualName>*
NOT parent_name:$$deleteme.<ActualName>*
Example
Original search
((process_name:csrss.exe parent_name:* -parent_name:smss.exe -parent_name:csrss.exe)) -(legacy:true OR enriched:true)
Suggested searches
(process_name:csrss.exe parent_name:* AND -(parent_name:smss.exe OR parent_name:csrss.exe OR parent_name:*smss.exe* OR parent_name:*csrss.exe*)) -(legacy:true OR enriched:true)
(process_name:csrss.exe parent_name:* AND -(parent_name:smss.exe OR parent_name:csrss.exe OR parent_name:$$deleteme.smss.exe* OR parent_name:$$deleteme.csrss.exe*)) -(legacy:true OR enriched:true)