Per-user Custom Rules Not Working as Expected

Products

• Carbon Black App Control

Issue/Introduction

In version 8.9 and newer, per-user custom rules may not evaluate as expected when a file is executed from a remote network share (SMB). When this happens, the system might attribute the file operation to a different user account, which can cause executions that should be permitted by a custom rule to be blocked.

Environment

• App Control Console: All Supported Versions
• App Control Windows Agent: 8.9.0 - 8.9.6
• Microsoft Windows: All Supported Versions

Cause

Agent Versions 8.9.0 – 8.9.6

• The Agent began evaluating the User Identity (SID) at the process thread level rather than just the process level. This caused attribution mismatches where file operations were incorrectly attributed to a remote user (such as a service account or console user) instead of the local user executing the action.
• Resolution: Fixed in Agent 8.10.0 (Reference: EPCB-21383).

Agent Versions 8.10.0 and Later

• While the updated Thread Identity Check improves overall security, it can still misidentify the execution context of scripts or file operations.The Agent may attribute an action to an impersonated user rather than the user who originally launched the script. Consequently, custom rules designed to allow actions for the originating user may fail to apply, resulting in unexpected block events.
• This ongoing issue is currently being tracked under CRE-24921.

Resolution

1. Upgrade to App Control 8.10.0+
2. If the issue still occurs, Collect "Rule Not Working" Logs for App Control Agent ,contact Technical Support, and reference this CRE-24921.