Carbon Black Cloud: Receiving Alerts "The Application (Filename) Invoked Another Application (Filename)"
search cancel

Carbon Black Cloud: Receiving Alerts "The Application (Filename) Invoked Another Application (Filename)"

book

Article ID: 289296

calendar_today

Updated On:

Products

Carbon Black Cloud Endpoint Standard (formerly Cb Defense) Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

  • Getting a lot of alerts for "The application notepad.exe invoked another application (notepad.exe)" or another application
  • The application may show with an ADAPTIVE_WHITE_LIST reputation

Environment

  • Carbon Black Cloud Windows Sensor: All Supported Versions
  • Microsoft Windows: All Supported Versions

Cause

This alert is normally associated with the application hash in question having a NOT_LISTED or ADAPTIVE_WHITE_LIST reputation

Resolution

If this version of the application is trusted in the environment then the hash could be added to the approved list to prevent the alert

Additional Information

  • The notepad.exe hash that this has been seen the most with is 9e858931dd750839f98edcbe90acf73aa530c7c9485ce39e26c1e21190a5a729
  • Some versions of notepad.exe do have a Trusted_white_list cloud reputation and don't create this alert