Carbon Black Cloud: How to work with wildcards in path based policies

[#1]

Environment

• Carbon Black Cloud: All Versions
• Microsoft Windows: All Supported Versions

Objective

How to better understand wildcards and case sensitivity in a policy's path-based exclusions. 

Resolution

Single asterisk ( * )

• Matches 0 or more consecutive characters up to a single subdirectory level.
• Basically, it's a wildcard for that directory only. NON-recursive

Example:

C:\program files*\custom application\*.exe

This example will affect any executable files in:
C:\program files\custom application\
or
C:\program files(x86)\custom application\

Double asterisks ( ** )

• Matches a partial path across all subdirectory levels.
• Is recursive.

Example:

C:\Python27\Lib\site-packages\**

- This example will affect any files in that directory and all subdirectories.
C:\Python27\Lib\site-packages\
or
C:\Python27\Lib\site-packages\subdirectory one\
or
C:\Python27\Lib\site-packages\subdirectory one\subdirectory two\
or
C:\Python27\Lib\site-packages\subdirectory one\subdirectory two\subdirectory three\

Leading wildcards for Windows drives
To specify an application that runs on any directory (C:\ or D:\ or F:\), use a question mark ' ?  ':

?:\My App\test.exe

 

Additional Notes

All paths for Windows directories are not case-sensitive. 

Related Content

Carbon Black Cloud Documentation for Prevention Policy Settings
Carbon Black Cloud: Is sensor policy "Permissions" file path case-sensitive?