Threat Report: Exposing Malware in Linux-Based Multi-Cloud Environments | Download Now

Carbon Black Console: Why are there inaccurate results when using negation on process_publisher_state queries?

Carbon Black Console: Why are there inaccurate results when using negation on process_publisher_state queries?

Environment

  • Carbon Black Cloud Web Console: All Versions
    • Enterprise EDR
  • Carbon Black Cloud Microsoft Windows Sensor: All Supported Versions

Question

Why are queries returning processes that have a trusted signature or a verified signature, when querying negation on process_publisher_state:FILE_SIGNATURE_STATE_TRUSTED

Answer

  • Querying the negation of a process_publisher_state value, will return all states which does not equal that particular state. 
  • At this time, there are 10 different values for the state, so negating only one value means that the results will be for events in the other 9 states

Additional Notes

  • The 10 process_publisher_state states are listed below:
    • FILE_SIGNATURE_STATE_INVALID
    • FILE_SIGNATURE_STATE_SIGNED
    • FILE_SIGNATURE_STATE_VERIFIED
    • FILE_SIGNATURE_STATE_NOT_SIGNED
    • FILE_SIGNATURE_STATE_UNKNOWN
    • FILE_SIGNATURE_STATE_CHAINED
    • FILE_SIGNATURE_STATE_TRUSTED
    • FILE_SIGNATURE_STATE_OS
    • FILE_SIGNATURE_STATE_CATALOG_SIGNED
    • UNRECOGNIZED
  • Example:
    • process_name:schtasks.exe AND -process_publisher_state:FILE_SIGNATURE_STATE_SIGNED
    • Returns all schtasks.exe events with process_publisher_state of:
      • FILE_SIGNATURE_STATE_INVALID
      • FILE_SIGNATURE_STATE_VERIFIED
      • FILE_SIGNATURE_STATE_NOT_SIGNED
      • FILE_SIGNATURE_STATE_UNKNOWN
      • FILE_SIGNATURE_STATE_CHAINED
      • FILE_SIGNATURE_STATE_TRUSTED
      • FILE_SIGNATURE_STATE_OS
      • FILE_SIGNATURE_STATE_CATALOG_SIGNED
      • UNRECOGNIZED
    • Search can either be to search for process_publisher_state:FILE_SIGNATURE_STATE_NOT_SIGNED or negate every state that is not desired in results. 

Related Content


Was this article helpful? Yes No
100% helpful (1/1)
Article Information
Author:
Creation Date:
‎01-19-2021
Views:
613
Contributors