Carbon Black Cloud: The sensor blocks scripts (cmd, bat, etc..) due to being fileless
search cancel

Carbon Black Cloud: The sensor blocks scripts (cmd, bat, etc..) due to being fileless

book

Article ID: 289834

calendar_today

Updated On:

Products

Carbon Black Cloud Endpoint Standard (formerly Cb Defense) Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

  • Observe Alert "The application cmd.exe invoked another application (cmd.exe) on behalf of explorer.exe. A Deny\Terminate Policy Action was applied."
  • Event Description "The application C​:\​​W​in​do​ws​\​​Sy​st​em​32​\​​cm​d.​ex​e invoked the application C​:\​​W​in​do​ws​\​​Sy​st​em​32​\​​cm​d.​ex​e. The operation was blocked by Cb Defense."
  • FILELESS TTP is not attached to the event

Environment

  • Carbon Black Cloud (Formerly PSC) Console: All supported versions
  • Endpoint Standard (Formerly CB Defense) Sensor: 3.1 and above
  • Microsoft Windows: All Versions

Cause

  • The sensor blocks scripts (cmd, bat, etc..) due to policy rule: Application at path: **\cmd.exe Executes a fileless script Deny\Terminate operation 
  • The script is is interpreted as being FILELESS because script is executed using cmd.exe /c. Example:
C:\Windows\system32\cmd.exe /c "C:\path\scriptname.cmd"

Resolution

  • REMOVE Blocking & Isolation rule: Application at path: **\cmd.exe Executes a fileless script Deny\Terminate operation 
OR
  • ADD Permission rule: Application at path: C:\Windows\System32\cmd.exe Executes a fileless script Allow & Log

Additional Information

  • The cmd /c switch starts a new CMD shell, carries out the command specified by string, and then terminates