Environment
EDR Server: 7.6.x+
EDR Windows Sensor: 7.2+
Question
If the sensor service stopped, why does CbEDRAMSI.dll continue to load into processes?
Answer
If AMSI event collection is enabled, then the DLL is registered with the OS to be loaded into any AMSI capable process. To stop this from happening, unselect 'Fileless script loads' in Sensor > Groups > Settings > Event Collection and allow the sensor check-in to retrieve the updated configuration.
Related Content
