Carbon Black Cloud: Windows applications randomly hang when accessing WMI service

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)

Issue/Introduction

1. Windows applications randomly stop or hang, ranging from hours to days between events.
2. Problem seems to be worse on busier machines.
3. Problem occurs on wide range of Windows OS's.
4. Restarting the Windows WMI service fixes the hanging.
5. Placing the sensor host in Bypass mode fixes the hanging.
6. Running this get-process command from a powershell for the wmiPrvSE.exe process ID returns almost all  "Suspended" states:

username> (get-process -id 1234).threads.waitreason
Suspended
Suspended
Suspended
Unknown
Suspended
Suspended
.
.
.

Environment

• Carbon Black Cloud Sensor: All Windows versions 3.7.x and earlier
• Carbon Black Cloud Console: All Versions

Cause

This is issue DSEN-13250. T

Resolution

This issue is fixed in 3.8.x Windows sensors.

To address this "app-hook" issue hanging the WMI service for 3.7.x sensors and earlier , add an API Bypass rule as so:

1. Edit the policy for the target Windows sensor hosts
2. Prevention Tab; Permissions; Check "Performs any API operation" and  Application(s) at Path:   

*:\Windows\Sys*\wbem\WmiPrvSE.exe

Additional Information

Note that the API bypass will only prevent future occurrences and not "heal" sensor hosts currently in a bad state.