CB Response: How to search for processes with no cmdline
search cancel

CB Response: How to search for processes with no cmdline

book

Article ID: 287718

calendar_today

Updated On:

Products

Carbon Black EDR (formerly Cb Response)

Issue/Introduction

Search for processes with empty cmdline line or the reverse:  search for processes with a non-empty cmdline

Environment

  • CB Response: All versions

Resolution

  • To search for processes with *no* cmdline value, add:
-cmdline:*
  • To search for processes that have any cmdline value (not empty), add:
cmdline:*