cb-core Engine for VMware Carbon Black Endpoint Security
cb-core.exe is the central runtime for the cb-core Endpoint Security Agent. It orchestrates policy enforcement, threat detection, and local protection routines, while coordinating with the Carbon Black Cloud console. As a background service, it initializes on startup, manages modules, and handles real-time event processing.
cb-core.exe loads core modules, starts the policy engine, and maintains a secure TLS channel to the management console. It uses multi-threading to perform scanning, rule evaluation, and health checks, while persisting configuration changes and reporting events to the cloud.
cb-core.exe is the legitimate core executable of the cb-core Endpoint Security Agent from VMware Carbon Black, installed by enterprise deployments. When retrieved from official channels and integrated with the management console, it runs as a signed, trusted service. In standard configurations, it should not be flagged as malware, though tampering or misplacement can cause false positives.
cb-core.exe is not a virus when obtained from official VMware Carbon Black sources and installed through approved channels. However, malware authors sometimes mimic legitimate processes by copying executables or placing them in suspicious folders. If cb-core.exe appears in an uncommon path or lacks a valid signature, treat it as potentially malicious and verify using vendor tooling.
Red Flags: cb-core.exe files located outside the official VMware Carbon Black directories, unsigned or with altered timestamps, or renamed copies in user-writable paths (e.g., Downloads, AppData) should be treated as suspicious. Unusual network activity or frequent name changes are also warning signs.
Reasons it's running:
cb-core.exe is the central engine of the cb-core Endpoint Security Agent. It enforces policies, runs detection rules, reports telemetry to the Cloud Console, and coordinates updates. It operates as a background service to provide continuous protection.
Yes, cb-core.exe is a legitimate component of VMware Carbon Black's endpoint protection suite. It should be signed, located in official program folders, and show expected network activity and event logs in the management console. If anything looks unusual, verify with the vendor.
CPU usage can spike during scans, rule evaluations, or telemetry dispatch. Normal operation shows occasional bursts, but sustained high usage may indicate scans are running, policies are complex, or there is a misconfiguration or conflict with other security software.
Uninstalling the agent removes protection. If you must remove it, use the official uninstall procedure from the vendor or enterprise console, following your organization’s policy. Always ensure you have a replacement security solution in place.
Verify the file location, check the Authenticode signature to confirm VMware Carbon Black as the publisher, compare SHA-256 hashes with vendor-provided values, and scan for any suspicious copies or tampering.
Common installation paths include C:\Program Files\VMware Carbon Black\cbcore.exe or C:\Program Files\VMware Carbon Black\cbcore\cb-core.exe. Exact paths depend on the deployment and version, as configured by your administrator.