Endpoint Standard: Mac Sensor reporting TamperBehavior4 Alerts
search cancel

Endpoint Standard: Mac Sensor reporting TamperBehavior4 Alerts

book

Article ID: 291091

calendar_today

Updated On:

Products

Carbon Black Cloud Endpoint Standard (formerly Cb Defense)

Issue/Introduction

Alerts in the console can be seen with the following context:
  • The application /usr/libexec/xpcproxy attempted to disable the Cb Defense Sensor, by calling the function "TamperBehavior4". The operation was blocked by Cb Defense.
 

Environment

  • Carbon Black Cloud Console: All Versions
  • Endpoint Standard macOS Sensor: 3.4.2.23
  • Apple macOS: All Version

Cause

 Launchd/xpcproxy is gathering process(daemon) metrics which exhibits scraping-like behavior.

Resolution

This is a known issue and the fix will be addressed in an upcoming Mac sensor release (3.4.4)