Environment
- EDR Server: All Supported Versions
- EDR Sensor: All Supported Versions
Question
Why in the captured events for the following command "find / -perm -u=s -type f 2>/dev/null" the 2>/dev/null is stripped from the command line
Answer
- These redirections look like part of the command, but they are actually controlling shell behavior before the command is executed
- When
bash runs a command like this, it does this:
- Fork to create a new process
- Open a file handle to /dev/null
- Remap that over the stderr file descriptor
- Exec the command line not including any redirections
- In this kind of syntax, the
find command never sees these redirections; it’s not part of the command, it’s something bash does to the environment before running the command
