Carbon Black Cloud: Processes crash due to CbAMSI
book
Article ID: 286414
calendar_today
Updated On:
Products
Carbon Black Cloud Endpoint Standard (formerly Cb Defense)
Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)
Issue/Introduction
- Issue first appears in 3.6.0.2076, previous versions work
- Path to execution includes non-ASCII characters such as kanji
- Windows Application log shows a failure for MSACCESS.exe pointing to CbAMSI.dll as the failing module
- Failed application path: C:\Program Files\Microsoft Office\Root\Office*\MSACCESS.EXE
Failed module path: C:\WINDOWS\system32\CbAMSI.dll
Environment
- Carbon Black Cloud Sensor: 3.6.0.2076
- Endpoint Standard
- ThreatHunter
- Microsoft Windows: All Supported Versions
- Non-ASCII character file paths
Cause
This is due to a known issue with non-ASCII characters in CbAMSI
Resolution
- This issue is fixed in 3.7.0.1253 and higher and referenced as UAV-2191 in release notes
Additional Information
- If upgrading to 3.7.0.1253 is not possible, workarounds are as follows
- Re-install a sensor version prior to 3.6.0.2076
- Update file path to not include non-ASCII characters
- Temporarily disable AMSI prevention functionality (contact Tech Support Team for further suggestions)
WARNING: Disabling AMSI will have a negative impact to the CBC's visibility as well as detection and prevention efficacy
- If issue persists, open a support ticket with Carbon Black including a crash dump which can be gathered via procdump configuration
Feedback
thumb_up
Yes
thumb_down
No