Endpoint Standard: November 2021 AMSI Prevention Rules Cause Blocking of Known Good Scripts

[#1]

Environment

• Endpoint Standard Sensor: 3.6.x.x and Higher
• Windows OS: All Supported Versions

Symptoms

• Carbon Black deployed two AMSI prevention rules between 11/17/21 - 11/22/21 which resulted in the following two issues:
  • Endpoint Standard: MS Office applications blocked by AMSI prevention due to malicious WMI process ex...
  • Endpoint Standard: VBS scripts blocked with alert - "The Application Wscript.Exe Attempted To Execut...

Cause

While we expect these alerts to provide high fidelity detections that detect malicious activity in the wild, we recognize that some customers will need to dismiss these alerts for future if they are not applicable to their specific environment. 

Resolution

• Modification of AMSI rules to change from prevention to detection has been completed for all Production environments
• This change will still result in a detection alert, but as a result the sensor will no longer block known good scripts

Related Content

Endpoint Standard: What version of Sensor Supports AMSI Prevention?
Endpoint Standard: MS Office applications blocked by AMSI prevention due to malicious WMI process ex...
Endpoint Standard: VBS scripts blocked with alert - "The Application Wscript.Exe Attempted To Execut...
Carbon Black Cloud: How to Verify Connection to content.carbonblack.io (3.6.x.x and Higher)
Carbon Black Cloud: Is access to content.carbonblack.io required?
Carbon Black Cloud: How to check current dynamic Sensor Management Content Manifests
Antimalware Scan Interface (AMSI) - Win32 apps