CB Response: False Positive on Watchlist Query containing digsig_publisher
search cancel

CB Response: False Positive on Watchlist Query containing digsig_publisher

book

Article ID: 287711

calendar_today

Updated On:

Products

Carbon Black EDR (formerly Cb Response)

Issue/Introduction

  • Watchlist using "-digsig_publisher"  to exclude a specific publisher
  • Watchlist generates false positive for a binary that is actually signed

Environment

  • CB Response:  All Versions

Cause

  • Binary signature information is gathered from the endpoints, not queried on server side.
  • Incorrect signature data uploaded from an endpoint where the binary is not signed properly
  • Issue may repeat each time invalid signature data is uploaded from an endpoint

Resolution

  1. Create a watchlist that will trigger exclusively against binary data:  
(md5:"<md5>" AND -digsig_publisher:"<publisher>")
  1.  Enable alerting against your created watchlist
  2.  Once an endpoint reports the md5/binary without publisher details again, the alert will contain details of the reporting endpoint
  3.  Followup with your IT/System Admins regarding the state of the binary on the endpoint and why it is not properly signed.  Addressing the unsigned binary on the endpoint will stop future false-positives

Additional Information