App Control: Large Count of New Unapproved DLLs after Upgrade to Rules 1.4.3

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

• Large number of new DLLs discovered on the device
• Larger than average blocks on these DLLs
• New DLLs are discovered by:
  • IntegrityCheck
  • Execution

Environment

• App Control Server: 8.1.8 (Formerly CB Protection)
• App Control Agent: All Versions
• Rules Version: 1.4.3

Cause

This is caused by a defect in the Rules Installer version 1.4.3 

Resolution

Upgrade to rules version 1.4.4 https://community.carbonblack.com/t5/Documentation-Downloads/CB-Protection-Rules-Installer-v1-4/ta-p/73532

Additional Information

This item is tracked internally as EA-16473