PSC: Will filename be shown if command uses IO redirection? (Mac)

Products

• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

If a command is run in the terminal which redirects output to a file, will the name of the file be shown in the Carbon Black Cloud Console?

command argument >> file_redirect

Environment

• PSC Console: All Versions
  • CB Defense
  • CB ThreatHunter
• PSC Sensor: All Versions
• Apple macOS: All Supported Versions

Resolution

No. The output filename will not be recorded.

Additional Information

This is a limitation of the operating system. When a command is run using IO redirection, the output file redirection is handled by zsh/sh/bash prior to the process creation and effectively removed from the command arguments. The subsequent call to execvp does not understand what file redirections are and cannot persist in the argument list accordingly.