4.5. Collector Detection by Antivirus and EDR

Cyber Triage’s collection tool, named the Collector, can be falsely identified by antivirus and Endpoint Detection and Response (EDR) systems as being malicious.

Notably:

  • The CyberTriageCollector.exe program can be flagged when it is run on the target system or when it is run from your analysis system and being pointed to disk images or logical files.

  • The CyberTriageGUI.exe program can be flagged when it is run on the target system. It uses a graphical interface framework that attackers have started to also use.

Observations of this behavior will include:

  • A collection will stop early. Error messages in the JSON output can sometimes indicate if an error happened and it gracefully shut down early or was quickly terminated. If the process was killed by the EDR, then no graceful shutdown message will exist.

  • The local executable will not exist when you try to add a disk image or logical file set. To fix this, you must re-install Cyber Triage.

We recommend that you add the hashes of these tools to your goodlist on your EDR. The SHA256 value is given in the release notes, as can be seen on the History.

You may also need to exclude Cyber Triage’s install/data folders from AV/EDR scanning entirely, rather than just goodlisting the Collector’s hash: