CB Defense: Why didn't the sensor catch ransomware simulation tests?
book
Article ID: 290110
calendar_today
Updated On:
Products
Carbon Black Cloud Endpoint Standard (formerly Cb Defense)
Issue/Introduction
Why didn't the sensor terminate tests run by ransomware simulators?
Environment
CB Defense Sensor: All Versions
CB Defense Console: All Versions
Resolution
Many ransomware simulators will run in an isolated folder created by the simulation rather than touching true user files. Defense will log updates to these files, but will not consider it ransomware until an actual user file is touched.