Carbon Black Cloud: How to Run Commands With Flags in Live Response

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)
• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

Run a command with flags in Live Response

Environment

Carbon Black Cloud Console: All Versions
Carbon Black Cloud Sensor: All Supported Versions

Resolution

Run the command with execfg cmd.exe /c followed by the command and the needed flags, for example: 

execfg cmd /c tasklist /svc /FI "IMAGENAME eq chrome.exe"