CB Defense: Why didn't the sensor catch ransomware simulation tests?

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)

Issue/Introduction

Why didn't the sensor terminate tests run by ransomware simulators?

Environment

• CB Defense Sensor: All Versions
• CB Defense Console: All Versions

Resolution

Many ransomware simulators will run in an isolated folder created by the simulation rather than touching true user files. Defense will log updates to these files, but will not consider it ransomware until an actual user file is touched.