App Control: How Resolve Executions Allowed By "File Loaded before service"
book
Article ID: 289363
calendar_today
Updated On:
Products
Carbon Black App Control (formerly Cb Protection)
Issue/Introduction
Seeing Execution Allowed Events with "File loaded before service" and "inactive"
Environment
App Control: 7.2.x and Higher
Cause
This happens if the file was already loaded or executes, before the Agent service has started
Resolution
Enabling bans to stop running processes can prevent this.
This feature can enforce bans by kernel driver and terminate processes with banned images before service starts.
Details on enabling this capability are available in Chapter 8 of the User Guide under section Enabling Bans to Stop Running Processes.
The way active banning works is that periodically the Parity driver checks all running programs and loaded images.
if it finds something running that has been banned and active banning is enabled, it will actually kill the process.
Caution is required if considering turning this on as it can crash the system if a banned image happens to be loaded into a service that is vital for the OS to remain running, it will still kill it.