EDR: Netconns showing for a process that should not have netconns

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

Netconns are showing for processes that should not have netconn attempts like cat, grep, sed, etc. 

Environment

• EDR Sensor: All Versions
• Linux: All Versions
• macOS: All Versions

Cause

Another process is calling multiple fork executes using the same process id

Resolution

CB-21348 has been created to add start time to the sensor checks for pids in order to split the behavior

Additional Information

• Please subscribe to this article for updates and expected fix version