Environment
- Carbon Black Cloud Windows Sensor: All versions
- Carbon Black Cloud Server: All versions
- Microsoft Windows OS: All versions
Question
Which of the CBC Windows sensor's executables are responsible for creating network connections?
Answer
- RepMgr.exe (communicates with cloud)
- upd.exe (signature pack updates)
- osqueryi.exe (potentially via
curl table queries) - cbc_plugin_extension.ext.exe (potentially via
cb_sensor_curl table queries)
