Just Published! Threat Report: Exposing Malware in Linux-Based Multi-Cloud Environments | Download Now

EDR: Why Does CbEDRAMSI Load into Processes After CB Sensor has Stopped?

EDR: Why Does CbEDRAMSI Load into Processes After CB Sensor has Stopped?

Environment

EDR Server:  7.6.x+
EDR Windows Sensor: 7.2+

Question

If the sensor service stopped, why does CbEDRAMSI.dll continue to load into processes?

Answer

If AMSI event collection is enabled, then the DLL is registered with the OS to be loaded into any AMSI capable process.  To stop this from happening, unselect 'Fileless script loads' in Sensor > Groups > Settings > Event Collection and allow the sensor check-in to retrieve the updated configuration.

Related Content


Labels (1)
Tags (2)
Was this article helpful? Yes No
No ratings
Article Information
Author:
Creation Date:
‎05-19-2022
Views:
69
Contributors