CB Response: Can Malicious Files Be Deleted Using CB Response After Banning The Hash?

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

Can malicious files be deleted from endpoints using CB Response after banning the hash?

Environment

• CB Response Server: 6.2.4 and Higher
• CB Response Sensor: All Supported Versions

Resolution

CB Response does not currently have the functionality to delete a file corresponding to its banned hash from the console.

Additional Information

Live Response can be used to remote into the endpoint and delete the file whose hash was banned.