Carbon Black Cloud: Does the CBC sensor capture events around user input credentials in any domain?
search cancel

Carbon Black Cloud: Does the CBC sensor capture events around user input credentials in any domain?

book

Article ID: 288974

calendar_today

Updated On:

Products

Carbon Black Cloud Endpoint Standard (formerly Cb Defense) Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

Can the CBC sensor capture events around when a user would input credentials into any domain, or phishing sites, etc.?

Environment

  • Carbon Black Cloud Sensor: All Supported Versions
  • Microsoft Windows: All Supported Versions
  • Mac OSX: All Supported Versions
  • Linux: All Supported Versions

Resolution

Currently the CBC product does not log that level of detail. At best, you can see a browser making a network connection to a domain. However, the CBC sensor does not:
- Know whether or not the domain/site is a phishing site or legit
- Know if a userr submitted anything to the site
- Know if that submission contained credentials