Just Published! Threat Report: Exposing Malware in Linux-Based Multi-Cloud Environments | Download Now

EDR: Where are the sensor files installed on macOS?

EDR: Where are the sensor files installed on macOS?

Environment

  • EDR: All Versions
  • Apple macOS: All Supported Versions

Question

Where are the EDR sensor files installed on macOS?

Answer

6.2.6 and earlier sensors:

FilesLocation
Sensor Service /Applications/CarbonBlack/CbOsxSensorService
Uninstall Scripts/Applications/CarbonBlack/sensoruninst.sh
Network Monitor/System/Library/Extensions/CbOsxSensorNetmon.kext
Process Monitor/System/Library/Extensions/CbOsxSensorProcmon.kext
Settings File/var/lib/cb/sensorsettings.ini


6.2.7 sensor:

FilesLocation
Sensor Service /Applications/CarbonBlack/CbOsxSensorService
Uninstall Scripts/Applications/CarbonBlack/sensoruninst.sh
Network Monitor/System/Library/Extensions/CbOsxSensorNetmon.kext
Process Monitor/System/Library/Extensions/CbOsxSensorProcmon.kext
Settings File/var/root/Library/Preferences/com.carbonblack.sensor-service.plist
 

6.3.0 sensor:

FilesLocation
Sensor Service /Applications/Vmware Carbon Black EDR/Contents/MacOS/CbOsxSensorService
Uninstall Scripts/Applications/Vmware Carbon Black EDR/Contents/Resources/sensoruninst.sh
Network Monitor/System/Library/Extensions/CbOsxSensorNetmon.kext
Process Monitor/System/Library/Extensions/CbOsxSensorProcmon.kext
Settings File/var/root/Library/Preferences/com.carbonblack.sensor-service.plist
 

7.0.1 and later sensor:

FilesLocation
Sensor Service /Applications/Vmware Carbon Black EDR/Contents/MacOS/CbOsxSensorService
Uninstall Scripts/Applications/Vmware Carbon Black EDR/Contents/Resources/sensoruninst.sh
On macOS 10.x, Network Montior/System/Library/Extensions/CbOsxSensorNetmon.kext
On macOS 10.x, Process Monitor/System/Library/Extensions/CbOsxSensorProcmon.kext
On macOS 11.x, User-mode Monitorrun systemextensionsctl list.  Expected Output should contain com.carbonblack.es-loader.es-extension [actived/enabled]
Settings File/var/root/Library/Preferences/com.carbonblack.sensor-service.plist

Related Content


Labels (1)
Tags (2)
Was this article helpful? Yes No
50% helpful (1/2)
Article Information
Author:
Creation Date:
‎09-09-2020
Views:
3053
Contributors