Cb Defense: How To Search For Files On Removable Drives

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)

Issue/Introduction

Query within the CB Defense Console to gather information regarding files being run from USB devices in an environment

Environment

• Cb Defense PSC Console: All Versions

Resolution

1. From the Cb Defense dashboard select Investigate.
2. Identify the time frame of the events under investigation be selecting the drop down in the top right.
3. To view files that were executed or found on removable media across all devices within the time selected use this query

   (NOT "local disk" AND "the file") AND ("the file" AND NOT "on network drive") AND ("the file" AND "Removable media")

4. At any time it may be helpful to change the VIEW BY tab options in the top left between (Events, Applications, or Devices)
5. Using the above query additional filters can be applied to new queries in order to investigate specific incidents:
   1. To remove events where the signature of the file was found to be signed

      NOT processAvCategory.sigcheck:signed AND (NOT "local disk" AND "the file") AND ("the file" AND NOT "on network drive") AND ("the file" AND "Removable media")

   2. To remove events from select IPs or IP ranges use NOT “X.X.X.X”

      NOT “X.X.X.X” AND (NOT "local disk" AND "the file") AND ("the file" AND NOT "on network drive") AND ("the file" AND "Removable media")

   3. To select events from a particular policy use “POLICY_NAME” or to filter those events out use NOT “POLICY_NAME”

      NOT “POLICY_NAME” AND (NOT "local disk" AND "the file") AND ("the file" AND NOT "on network drive") AND ("the file" AND "Removable media")

   4. To investigate a specific user

      "USER_NAME" AND (NOT "local disk" AND "the file") AND ("the file" AND NOT "on network drive") AND ("the file" AND "Removable media")

Additional Information

• In order to use more than one word as a single search term you must combine those words within quotation marks.
• To apply conditions or to evaluate within a query use: AND, OR, NOT and ( )
• For example the following search terms need to be used "as-is" when searching the Event field within the Investigate panel

  “the file”
  “local disk”
  “on network drive”
  “removable media"

• The following search terms would be replaced with variables of your choosing

  "X.X.X.X":<IP address>
  "POLICY_NAME":<Name of the policy>
  "USER_NAME":<Specific user>