Threat Report: Exposing Malware in Linux-Based Multi-Cloud Environments | Download Now

Carbon Black Cloud: Windows applications randomly hang when accessing WMI service

Carbon Black Cloud: Windows applications randomly hang when accessing WMI service

Environment

  • Carbon Black Cloud Sensor: All Windows versions 3.7.x and earlier
  • Carbon Black Cloud Console: All Versions

Symptoms

  1. Windows applications randomly stop or hang, ranging from hours to days between events.
  2. Problem seems to be worse on busier machines.
  3. Problem occurs on wide range of Windows OS's.
  4. Restarting the Windows WMI service fixes the hanging.
  5. Placing the sensor host in Bypass mode fixes the hanging.
  6. Running this get-process command from a powershell for the wmiPrvSE.exe process ID returns almost all  "Suspended" states:
username> (get-process -id 1234).threads.waitreason
Suspended
Suspended
Suspended
Unknown
Suspended
Suspended
.
.
.

Cause

This is issue DSEN-13250. T

Resolution

This issue is fixed in 3.8.x Windows sensors.

To address this "app-hook" issue hanging the WMI service for 3.7.x sensors and earlier , add an API Bypass rule as so:
  1. Edit the policy for the target Windows sensor hosts
  2. Prevention Tab; Permissions; Check "Performs any API operation" and  Application(s) at Path:   
*:\Windows\Sys*\wbem\WmiPrvSE.exe

Additional Notes

Note that the API bypass will only prevent future occurrences and not "heal" sensor hosts currently in a bad state.

 

Related Content


Was this article helpful? Yes No
No ratings
Article Information
Author:
Creation Date:
‎04-02-2021
Views:
1157
Contributors