Carbon Black Cloud: The "translate" arrow in process analysis page does NOT decrypt when the "-EncodedCommand" operator is used, but it DOES when the /e or -e operators are used.
book
Article ID: 286866
calendar_today
Updated On:
Products
Carbon Black Cloud Endpoint Standard (formerly Cb Defense)Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)
Issue/Introduction
The "translate" arrow in process analysis page does NOT decrypt when the "-EncodedCommand" operator is used, but it DOES when the /e or -e operators are used.
Environment
Carbon Black Cloud Console: All versions
Carbon Black Cloud Sensor: All Windows versions
Cause
This is Console issue TR-6805.
Resolution
Issue is currently in Engineering (as of January, 2023).
Additional Information
Only the format "-EncodedCommandline" is problematic. The equivilant formats "/e" and "-e" decode properly.