Lsass Block Events When the Application is Bypassed "requested the content of lsass.exe. A Deny policy action was applied."

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)

Issue/Introduction

• Ignore Rules are in place but still seeing events like "The application parity.exe requested the content of lsass.exe. A Deny policy action was applied."

Environment

• Carbon Black Cloud Sensor: 3.8.0.627 - 3.9.1
• Microsoft Windows: All Supported Versions

Cause

Known issue with the built in ruleset

Resolution

Upgrade to sensor version 3.9.2 or above where this issue has been resolved

Additional Information

This is not known to have any effects on the App Control product.