App Control: File Creation Rule for Installing Microsoft Teams
search cancel

App Control: File Creation Rule for Installing Microsoft Teams

book

Article ID: 286746

calendar_today

Updated On:

Products

Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

'New unapproved file to computer' Events similar to one below reported when installing Microsoft Teams on a Windows 10 machine:
Computer discovered new file 'c:\users\User1\appdata\local\microsoft\teams\stage\libegl.dll' [a1ab1969d575e26ed1f0c6169b0c2f821c30da3cd253ace254f15765e551a8be]. DiscoveredBy[Kernel:Create]

Environment

  • App Control Server: All Supported Versions
  • App Control Agent: All Supported Versions
  • Microsoft Windows: All Supported Versions

Cause

Some files used to install Microsoft Team are not being approved by Publisher (Microsoft).

Resolution

  1. Login to the Console and navigate to Rules > Software Rules > Custom > Add Custom Rule.
  2. Add following values: 
    • Platform: Windows 
    • Rule Type: File Creation Rule 
    • Write Action: Approve 
    • Path or File:
      <LocalAppData>\microsoft\teams\*\resources\app.asar.unpacked\node_modules\*.node 
      <LocalAppData>\microsoft\teams\*\resources\app.asar.unpacked\node_modules\*.dll 
      <LocalAppData>\microsoft\teams\stage\*.dll 
      <LocalAppData>\microsoft\teams\current\*.dll
      
    • Process:
      <LocalAppData>\microsoft\teams\update.exe
      <LocalAppData>\squirreltemp\update.exe
    • Apply to the desired 'Policies'
    • Click 'Enabled'
  3. Save the new Custom Rule.