Environment
- Carbon Black Cloud Sensor: 3.9.0 and Higher
- Microsoft Windows: All Supported Versions
Symptoms
Large quantity of alerts in console reporting process injection via hollowing, triggered by rule "Report Process Hollowing".
Example:
The application xxx.exe injected code into another process (xxx.dll) via hollowing.
Cause
- The large quantity of these Alerts are due to a series of known issues in recent 3.9 Sensor versions.
- On 3.9.0.2357, the problem was identified and addressed in the resolution of DSEN-20840.
- On 3.9.1.2464, additional unexpected detections of this behavior are currently being addressed by engineering under DSEN-22991, which is expected to be resolved in the 3.9.2 Sensor release.
Resolution
Upgrade Sensor version to 3.9.1 or 3.9.2, when it becomes available.
