Just Published! Threat Report: Exposing Malware in Linux-Based Multi-Cloud Environments | Download Now

CB Defense: Why does the path in the command line field not match what is listed in the event?

CB Defense: Why does the path in the command line field not match what is listed in the event?

Environment

  • CB Defense Console: Current Version
  • CB Defense Sensor: 2.x and Higher

Question

Why does the path in the command line field not match what is listed in the event?

Answer

The sensor could be reporting the absolute path, which in the case of mapped drives, tend to be the share path. Whereas the commandline used by the program may reference the mapped drive directly.

Additional Notes

  • Commandline arguments may differ depending on how a share was mapped to the system and at what point in the path it was mapped.
  • Example:
    • What the sensor sees and displays in the event data
      • \\Company\Share\For\Data\important.csv
    • What could be displayed as part of the "Commandline":
      • For a drive mapped at \\Campany\Share:
        • Z:\For\Data\important.csv
      • Drive mapped at \\Company\Share\For\:
        • Z:\Data\important.csv

Related Content


Was this article helpful? Yes No
No ratings
Article Information
Author:
Creation Date:
‎03-07-2019
Views:
220
Contributors