CB Defense: Process Terminated For Incorrect PID
search cancel

CB Defense: Process Terminated For Incorrect PID

book

Article ID: 287030

calendar_today

Updated On:

Products

Carbon Black Cloud Endpoint Standard (formerly Cb Defense)

Issue/Introduction

Intermittent terminations for processes that do not match applied Policy rules and Reputations

Environment

  • CB Defense PSC Sensor: 3.1 - 3.4.0.962
  • Microsoft Windows: All Supported Versions

Cause

  • A new process receives a recycled PID that the Sensor previously associated with another process and reputation
  • The Sensor applies policy to the new process based on the previous processes reputation

Resolution

The issue is resolved with Sensor version 3.4.0.1016 and higher

Additional Information

  • This issue could potentially happen to any earlier version of the Sensor based on how it handles PIDs
  • Services are more likely to be effected due to reuse of PIDs for short lived processes