Agent Blocking Programs Hosted on a Network Share

Products

• Carbon Black App Control (formerly Cb Protection)

Issue/Introduction

Steps to allow remote executions of programs hosted on a Network location such as SMB, NFS, NAS

Environment

App Control Agent: All Supported Versions

Cause

• The App Control agent has no visibility of processes starting on a network share and therefore cannot apply custom rules specific to such processes.
• The App Control agent has no visibility into files being created or written on a network share and is unable to approve such files using custom rules.
• The App Control agent still detects remote executions and when they happen an alternative method to allow the execution is needed.

Resolution

1. Globally Approve the required file hashes prior to their execution.
   • This could be done via Trusted Directory or via the File Details page in the Console.
   • More details can be found in the User Guide chapter, Approving and Banning Software.
2. Create a Custom Rule that uses Execution Control (Allow) 
   • The Process may need to be set to Any in order for the Custom Rule to apply to a remote process.
   • The File Path may need to use the UNC path rather than a mapped drive path.
   • If using DFS Path Mapping, additional configuration may be required.