EDR Sensor: Unable to install updates via SCCM when "fileless script loads" event capture is enabled

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

• Unable to install updates or deploy new applications using SCCM when "fileless script loads" event capture is enabled
• Powershell scripts getting terminated unexpectedly

Environment

• EDR Sensor:  7.1.0 and 7.1.1 

Cause

     This issue was identified as a product bug:

#CB-33118 Null pointer dereference in AMSI.DLL AMSI extension that could lead to script failures for Powershell

Resolution

• This issue is fixed in Windows Sensor version 7.2.0 release
• As a workaround, disable 'Fileless script loads' in the 'Event Collection' section of the sensor group settings in the UI