logo

Knowledge Base

Access official resources from Carbon Black experts

IMPORTANT ANNOUNCEMENT: On May 6, 2024, Carbon Black User eXchange (UeX) and Case Management will move to a new platform!
The Community will be in read-only mode starting April 19th, 7:00 AM PDT. Check out the blog post!
You will still be able to use the case portal to create and interact with your support cases until the transition, view more information here!

Carbon Black Cloud: Watchlist hits from "Defense Evasion - Execution from Recycle Bin" report for processes incorrectly running from $recycle.bin

Carbon Black Cloud: Watchlist hits from "Defense Evasion - Execution from Recycle Bin" report for processes incorrectly running from $recycle.bin

Environment

  • Carbon Black Cloud Sensor: 3.7 and Below
  • Microsoft Windows: All Supported Versions

Symptoms

  • Alert Reason: Process <process_name> was detected by the report "Defense Evasion - Execution from Recycle Bin" in watchlist "Carbon Black Advanced Threats"
  • Path for event starts with 'c:\$recycle.bin'

Cause

Suspected bug with normalization - DSEN-15324

Resolution

Upgrade sensor to the latest 3.8+ sensor version

Labels (2)
Was this article helpful? Yes No
No ratings
Article Information
Author:
CB_Support
Creation Date:
‎07-24-2022
Views:
452
Contributors
logo

Copyright © 2005-2023 Broadcom. All Rights Reserved. The term “Broadcom” refers to Broadcom Inc. and/or its subsidiaries.