Just Published! Threat Report: Exposing Malware in Linux-Based Multi-Cloud Environments | Download Now

Endpoint Standard: How to Identify a Supported Device for Device Control

Endpoint Standard: How to Identify a Supported Device for Device Control

Environment

  • Carbon Black Cloud Console: November '20 Release (0.60) and Higher
  • Endpoint Standard Sensor: 3.6.0.1897 and Higher
  • Microsoft Windows: All Supported Versions

Objective

Identify a Supported Device for Device Control?

Resolution

To verify if the OS has identified the USB device as a mass storage device (DiskDrive) perform the following steps
  1. Open the windows registry editor by running regedit.exe
  2. Go to the registry key: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\USBSTOR
  3. Identify the USB device plugged in by its expected Class, Vendor, and Product Name
NOTE: If the usb device is not found in this registry key, the OS has not identified it as being a USB mass storage device (USB Disk Drive). 
  1. Expand the device of interest and select the alphanumeric key (Windows devices UID)
  2. Confirm the ClassGUID matches {4d36e967-e325-11ce-bfc1-08002be10318}
  3. Validate the sensor recognizes the registered external device
    1. Open a command prompt as Administrator
    2. Change directory to C:\Program Files\Confer
    3. Run: repcli device all
      • Look for the following in the output:
        • Device Info: Device Type [Disk]
        • Interface Tyle [USB]

Additional Notes

  • Device Control refers to USB, SCSI, etc. as the Interface Type. Currently USB (DiskDrive) is the only supported Interface Type for Device Control. 
  • All other USB devices will be found under: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\USB

Related Content


Was this article helpful? Yes No
No ratings
Article Information
Author:
Creation Date:
‎11-30-2020
Views:
1392
Contributors