Endpoint Standard: November 2021 AMSI Prevention Rules Cause Blocking of Known Good Scripts

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)

Issue/Introduction

• Carbon Black deployed two AMSI prevention rules between 11/17/21 - 11/22/21 which resulted in the following two issues:
  • https://community.carbonblack.com/t5/Knowledge-Base/Endpoint-Standard-Excel-exe-blocked-by-AMSI-prevention-due-to/ta-p/108884
  • https://community.carbonblack.com/t5/Knowledge-Base/Endpoint-Standard-VBS-scripts-blocked-with-alert-quot-The/ta-p/108905

Environment

• Endpoint Standard Sensor: 3.6.x.x and Higher
• Windows OS: All Supported Versions

Cause

While we expect these alerts to provide high fidelity detections that detect malicious activity in the wild, we recognize that some customers will need to dismiss these alerts for future if they are not applicable to their specific environment. 

Resolution

• Modification of AMSI rules to change from prevention to detection has been completed for all Production environments
• This change will still result in a detection alert, but as a result the sensor will no longer block known good scripts