App Control: Registry Rule is Not Working as Expected
book
Article ID: 288837
calendar_today
Updated On:
Products
Carbon Black App Control (formerly Cb Protection)
Issue/Introduction
Registry Rule is not working as expected after creating it
Environment
App Control Agent: All Supported Versions
App Control Console: All Supported Versions
Microsoft Windows: All Supported Versions
Cause
There are differences between Registry vs Custom Rules to take into consideration
Resolution
If a path ends with a "\", it matches only the key at that path. If a path ends in “\*”, the rule applies to all keys, sub-keys, and values underneath that path
If a path ends without a slash or wildcard, it applies only to a value (not a key) matching the path
For example: HKLM\SOFTWARE\FileReader\9.0\ViewOutput would match a value named "ViewOutput" but not a key named "ViewOutput"