Unexpected Reputation Based Block Events on Sensor 4.1+

Products

• Carbon Black Cloud Endpoint Standard

Issue/Introduction

• Unexpected reputation based blocks occurring on 4.1+ sensor
• Block event generally occurs shortly after boot and/or sensor service start
• Symptoms may include:
  • Events for applications being wrongly terminated.
    
    • Block event occurs that matches  'Unknown Application' > Invokes Fileless Script > Terminate, yet all associated artifacts—including the process, parent process, and fileless script—return a definitive (not unknown) reputation
  • False positive events for applications being terminated, without an actual termination occurring
    • Block event occurs that matches a "Unknown Application > Communicates over the network > Terminate
    • Netconn still shows as successful
    • This situation is a false positive, meaning that it shouldn't be terminated (and didn't) but it's logged as if it did

Cause

A rare, edge case scenario where a file's initial reputation status is logged as RESOLVING (Unknown) and although the reputation is subsequently updated the system continues to enforce (or falsely report) a block based on the original status. 

Resolution

1. Upgrade your sensor to version 4.2 or later.
2. Contact Technical Support to apply a required configuration property (configprop). The change is currently disabled by default while we monitor real-world performance. 

Additional Information

• This issue is being tracked under CRE-23145 and CRE-22848.
• For customers that are unable to upgrade:
  • The false positive blocks can be ignored.
  • For terminations that should not be occurring, a Sensor Exclusion may be required.