Just Published! Threat Report: Exposing Malware in Linux-Based Multi-Cloud Environments | Download Now

Carbon Black Cloud: Is access to content.carbonblack.io required?

Carbon Black Cloud: Is access to content.carbonblack.io required?

Environment

  • Carbon Black Cloud Console: All Versions
    • Endpoint Standard (was CB Defense)
    • Enterprise EDR (was CB ThreatHunter)
    • Audit and Remediation (was CB LiveOps)
    • Managed Detection (was CB ThreatSight)
  • Carbon Black Cloud Windows Sensor: 3.6 and Higher
  • Microsoft Windows: All Supported Versions

Question

Is access to content.carbonblack.io required?

Answer

Yes
  • In sensor version 3.6 and above, Enterprise EDR, AMSI Prevention, and Unified Binary Store must be able to access content.carbonblack.io in order to function correctly
  • More functions of the sensor (both new and pre-existing) are expected to rely on content.carbonblack.io in future sensor updates

Additional Notes

  • Although TCP requires bi-directional/full duplex communications, only outbound traffic to content.carbonblack.io is required from the sensor’s perspective (the sensor initiates the TCP handshake), as the perimeter stateful firewall should perform NAT and route traffic accordingly
  • The Unified Binary Store (UBS) is a centralized service that is part of the Carbon Black Cloud
    • UBS is responsible for storing all binaries and corresponding metadata (e.g. Signed, Product, CA and Publisher) for those binaries
    • UBS is included with Enterprise EDR
  • Microsoft Anti-Malware Scan Interface (AMSI) prevention and visibility extends default prevention capabilities for script-based Windows attacks by dynamically leveraging AMSI metadata to define and configure prevention logic
  • AMSI prevention rules are being crafted by VMware Carbon Black’s Threat Analysis Unit to include frequently used off-the-shelf attacker frameworks that are regularly seen in script-based attacks
  • AMSI prevention is packaged in with Endpoint Standard, but it is only supported on Windows 10 and greater and requires sensor version 3.6 and above
  • The content above and future functionality is made available via content manifests from content.carbonblack.io

Related Content


Was this article helpful? Yes No
100% helpful (1/1)
Article Information
Author:
Creation Date:
‎09-08-2020
Views:
1416
Contributors