Carbon Black Cloud: A low risk score is assigned for SAM registry dumping actions

[#1]

Environment

• Carbon Black Cloud(Formerly PSC) Console: All Supported Versions
  • Endpoint Standard(Formerly CB Defense)
  • Enterprise EDR(Formerly CB ThreatHunter)
  • Workload(Formerly CB Defense for VMware + VMware AppDefense)
  • Audit and Remediation(Formerly CB LiveOps)

Symptoms

• Below or similar actions are performed:

  reg.exe save hklm\sam c:\sam_test
  reg.exe save helm\system c:\system_test

• A risk score of 3(Yellow) is assigned and classified under category "Monitored"

Cause

By product design, this activity was incorrectly being marked with a low risk score

Resolution

A new detection has been created to raise a higher scoring alert when a user tries to export SAM registry keys

Additional Notes

The new added detection is valid for both HKLM\sam and HELM\system

Related Content

CB Collective Defense Cloud: File hash with no scan results is assigned low trust score
How To Report a Vulnerability in Carbon Black Products
Endpoint Standard: Reputation Priority