LiveQuery for Processes Whose Original Binary Has Been Deleted

Products

• Carbon Black Cloud Audit and Remediation

Issue/Introduction

LiveQuery for processes whose original binary has been deleted

Environment

• Carbon Black Cloud Console: All Supported Versions
  • Audit and Remediation
• Carbon Black Cloud Sensor: All Supported Versions

Resolution

Yes, it is possible to query a process when the binary is no longer on disk:

select * from processes where on_disk = 0 ;

Additional Information

• This query returns any process whose original binary has been deleted
• https://osquery.io/schema/4.6.0/