CB Defense: App blocked\terminated when attempted to inject code into itself
book
Article ID: 290243
calendar_today
Updated On:
Products
Carbon Black Cloud Endpoint Standard (formerly Cb Defense)Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)
Issue/Introduction
The app reputation is NOT_LISTED or UNKNOWN
The application attempts to inject code into itself
An Alert is not created on the PSC Console
A block or terminate event may not be observed in the PSC Console
A block or terminate event will be observed in the Windows Application Event Log. Example:
Information MM/DD/YYYY HH:MM:SS PM CbDefense 17 None "Information: The application ""C:\path\appname.exe"" attempted to inject code into the process ""C:\path\appname.exe"" by calling the function ""SetWindowsHookExW"". The operation was blocked and the application terminated by Confer."
Environment
Cb Defense PSC Console: All Versions
Cb Defense Sensor: All Versions
Microsoft Windows: All Supported Versions
Resolution
Carbon Black is currently investigating the root cause and fix for this issue.
To workaround this issue in the meantime, the affected application(s) can be whitelisted to prevent a block or terminate action when the application attempts to inject code into itself.