App Control: Registry Rule is Not Working as Expected

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

Registry Rule is not working as expected after creating it

Environment

• App Control Agent: All Supported Versions
• App Control Console: All Supported Versions
• Microsoft Windows: All Supported Versions

Cause

There are differences between Registry vs Custom Rules to take into consideration

Resolution

• If a path ends with a "\", it matches only the key at that path. If a path ends in “\*”, the rule applies to all keys, sub-keys, and values underneath that path
• If a path ends without a slash or wildcard, it applies only to a value (not a key) matching the path 

  For example: HKLM\SOFTWARE\FileReader\9.0\ViewOutput would match a value named "ViewOutput" but not a key named "ViewOutput"

• Macros are not supported in the Registry Path