CB Response: False Positive on Watchlist Query containing digsig_publisher
book
Article ID: 287711
calendar_today
Updated On:
Products
Carbon Black EDR (formerly Cb Response)
Issue/Introduction
Watchlist using "-digsig_publisher" to exclude a specific publisher
Watchlist generates false positive for a binary that is actually signed
Environment
CB Response: All Versions
Cause
Binary signature information is gathered from the endpoints, not queried on server side.
Incorrect signature data uploaded from an endpoint where the binary is not signed properly
Issue may repeat each time invalid signature data is uploaded from an endpoint
Resolution
Create a watchlist that will trigger exclusively against binary data:
(md5:"<md5>" AND -digsig_publisher:"<publisher>")
Enable alerting against your created watchlist
Once an endpoint reports the md5/binary without publisher details again, the alert will contain details of the reporting endpoint
Followup with your IT/System Admins regarding the state of the binary on the endpoint and why it is not properly signed. Addressing the unsigned binary on the endpoint will stop future false-positives