CB Defense: How to enable live response memory dump registry key in MST file

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)
• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

• How to enable the memory dump capability via live response for the 3.3.X sensor and above via MST file.
• This method will allow the registry key to be created automatically upon installation, without the need of manual intervention as documented in the following KB : https://community.carbonblack.com/t5/Knowledge-Base/Cb-Defense-How-to-Turn-On-Live-Response-Memory-Dump-Capability/ta-p/64647

Environment

• CB Defense Sensor: 3.3.X and Higher

Resolution

• Refer to the PSC-Sensor-Installation-guide (Page 12) - Unattended Windows sensor install by using Group Policy : https://community.carbonblack.com/t5/Documentation-Downloads/PSC-Sensor-Installation-Guide/ta-p/5215

1. Once you have configured all your additional items under the 'Property' table (step 10), navigate to the 'Registry' table, under 'Tables'.
2. Select the empty row under the last 'Registry Entry' --> right click --> Add Row.
3. This will open a 'Add Row' window. Add the following 'Value' information as follows;

Name	Value
Registry	regLiveMemDump
Root	2
Key	SYSTEM\CurrentControlSet\Services\ctifile
Name	InitializePhysicalMemoryDump
Value	#1
Component	ConferBaseDirComponent

4. Proceed to step 12.) of the installation guide.

Additional Information

• Before deploying to to multiple sensors, please test on one machine and ensure the registry key has been created successfully.
• To check to see if the registry key has been created execute the following command via elevated cmd prompt;
  • reg query HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ctifile | find "InitializePhysicalMemoryDump"

Output

• InitializePhysicalMemoryDump    REG_DWORD    0x1