Environment
- Carbon Black Cloud Console: All Versions
- Enterprise EDR
- Endpoint Standard
Objective
How to search for specific command line parameters in the investigate page
Resolution
In order to search for command line arguments, the switches must be escaped with a backslash (\) as well as hyphens/tacks (-).
For instance, in order to look for the Linux command "useradd" and "usermod" with the "-G" parameter, use the following search string:
process_cmdline:useradd\ \-G*
process_cmdline:usermod\ \-G*
If the process if being invoked by another, then use:
childproc_cmdline:useradd\ \-G*
childproc_cmdline:usermod\ \-G*
Or to search for Chrome running in incognito mode, use:
process_cmdline:\"C\:\\Program\ Files\ \(x86\)\\Google\\Chrome\\Application\\chrome.exe\"\ \-incognito
Additional Notes
Surrounding the command line and parameters with unescaped double-quotes will force the search engine to ignore the escape character (\).
Related Content
