Powershell scripts bypassed using Permission Rules gets blocked due to Isolation/Blocking rules

Products

• Carbon Black Cloud Endpoint Standard

Issue/Introduction

Powershell scripts bypassed using Permission Rules gets blocked due to Isolation/Blocking rules

Environment

• Carbon Black Cloud Console: Current Version
  • Endpoint Standard
• Carbon Black Cloud Windows Sensor: Supported Versions
• Microsoft Windows: Supported Versions

Cause

The full permission bypass on the script's home directory doesn't come into play because the Sensor sees the script not as it's own process but as an extension of the process that launched it which is powershell.exe in this case.

 

Resolution

Removing/Editing the Blocking and Isolation rule for powershell.exe allows the script to execute.

Additional Information

• It would take a full permission bypass on Powershell.exe to prevent the Blocking and Isolation rule from taking effect, which is something that should be avoided as that would make the environment vulnerable.