App Control: Tamper Protection Blocks from cb.exe

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

• Tamper Protection events from the cb.exe process.
• Modification (Change Value) of registry '\registry\machine\software\wow6432node\microsoft\windows\currentversion\uninstall{9f2d4e59-0528-4b22-b664-a6b0b8b482ee}\displayversion' by 'NT AUTHORITY\SYSTEM' was blocked because of Tamper Protection.

Environment

• App Control Agent: 8.1.x- 8.5.x

Cause

Known issue with prior versions. (EP-8383).

Resolution

Upgrade to agent version 8.6.0.162 or Higher where this has been corrected.