Microsoft Excel or Word terminates when clicking in the Save As > Browse search box with Carbon Black Cloud Windows Sensor active.

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)

Issue/Introduction

Microsoft Office applications like Excel or Word terminate with these exact steps:
File> Print THEN clicking Save As > Browse search box with Carbon Black Cloud Windows Sensor in Active Mode.

Environment

• Carbon Black Cloud Windows sensor: Any version.
• Carbon Black Cloud Server: Any version
• Microsoft Office products: Any version.

Cause

• The application crashing occurs when there is an Endpoint Standard rule configured such as:

  •   path: **\excel.exe (or word.exe)

      Operation attempt: Injects code / Modifies memory

      action: Terminate process

• This is Microsoft issue TrackingID #2404240040011839 that was unresolved as of July, 2024.

Resolution

A workaround is to change the policy action from Terminate to Deny.

Additional Information

Carbon Black internal tracking number: CRE-17912