Threat Report: Exposing Malware in Linux-Based Multi-Cloud Environments | Download Now

All Products: How to find installed Carbon Black KEXTs

All Products: How to find installed Carbon Black KEXTs

Environment

  • CB Defense Sensor: All Supported Versions
  • CB Response Sensor: All Supported Versions
  • CB Protection Agent: All Supported Versions
  • Apple macOS: All Supported Versions

Question

How can installed Carbon Black kexts be found on a Mac?

Answer

To search for which Carbon Black kexts are installed on a Mac, the following commands can be run in Terminal:

CB Defense and CB Response:
kextstat | grep -s com.carbonblack

CB Protection and CB Response (6.2.3 and earlier):
kextstat | grep -s com.bit9

Any kexts returned from these commands have been installed.

Additional Notes

  • CB Response Sensor Versions 6.2.3 and earlier may require both commands to see all installed kexts, as com.carbonblack and com.bit9 were used.
  • For specifics on TeamID as well as a full list of kexts for each product, see the macOS 10.13.4 Kext Approval Changes article under Related Content.
  • If any kexts are missing, the product must be reinstalled. Depending on the exact macOS version, a reboot may also be required.

Related Content


Was this article helpful? Yes No
100% helpful (1/1)
Article Information
Author:
Creation Date:
‎09-09-2020
Views:
1779
Contributors