App Control: How To Allow Specific Users to Execute a Banned File

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

This article will demonstrate how to craft a rule to allow specific users or groups to execute a banned file.

Environment

App Control Console:  All versions (was CB Protection)

Resolution

It’s important to understand how a rule could potentially impact endpoint security prior to creating it in your App Control environment. If there are any questions please contact your account team so they can engage Professional Services before continuing. 

To allow banned file execution please walk through the following steps. 

1. Navigate to Rules > Software Rules > Custom 
2. Click 'Add Custom Rule'
3. Create a Name
4. Select Execution Control 
5. Complete the Path or File, Process, and User or Group sections
6. Make the rule as targeted as possible
7. Rank the rule higher than the rule used to ban the file in question