CB Defense: App blocked\terminated when attempted to inject code into itself

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)
• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

• The app reputation is NOT_LISTED or UNKNOWN
• The application attempts to inject code into itself
• An Alert is not created on the PSC Console
• A block or terminate event may not be observed in the PSC Console
• A block or terminate event will be observed in the Windows Application Event Log. Example: 

  Information	MM/DD/YYYY HH:MM:SS PM	CbDefense	17	None	"Information: The application ""C:\path\appname.exe"" attempted to inject code into the process ""C:\path\appname.exe"" by calling the function ""SetWindowsHookExW"". The operation was blocked and the application terminated by Confer."

Environment

• Cb Defense PSC Console: All Versions
• Cb Defense Sensor: All Versions
• Microsoft Windows: All Supported Versions

Resolution

• Carbon Black is currently investigating the root cause and fix for this issue. 
• To workaround this issue in the meantime, the affected application(s) can be whitelisted to prevent a block or terminate action when the application attempts to inject code into itself.