Carbon Black Cloud: How to Find and Identify a Banned Hash in the Console
search cancel

Carbon Black Cloud: How to Find and Identify a Banned Hash in the Console

book

Article ID: 290339

calendar_today

Updated On:

Products

Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

Identify data in the Carbon Black Cloud Console that is related to banned hashes

Environment

  • Carbon Black Cloud Console: All Versions
  • Carbon Black Cloud Windows Sensor: 3.5.0.1278 and higher
  • Carbon Black Cloud Linux Sensor: 2.6.0 and higher

Resolution

Below are three examples of how to find data related to banned hashes:
  • Navigate to the Alerts page and look for alerts with the text:
    • "Process xxxx invoked another process (yyyy). Policy actions applied: Deny"
    • In an Enterprise EDR only org, the Alert Type facet category is not shown
    • In an Endpoint Standard + Enterprise EDR org, Alerts for Hash Banning will continue to be CB Analytics Alerts
  • Alternatively, it is possible to search on the Investigate page for matching events:
    1. Search in Investigate on the Processes tab for any combination of the following:
      • sensor_action:DENY
      • sensor_action_reason:POLICY_DENY
      • hash:(hash_on_the_company_banned_list)
    2. Select Process Analysis for any of the matching processes, then search in the Events Table search bar for any combination of the following:
      • sensor_action_reason:POLICY_DENY
      • filemod_sha256:(hash_on_the_company_banned_list)
  • Alerts page search:
    • sensor_action:DENY
    • ttp:run_banned_list_app