Carbon Black Cloud: Remote error 0x00000002 - The system cannot find the file specified

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)
• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

• Live Response execfg command gives error:

  Remote error 0x80070002 - The system cannot find the file specified.

• Working directory has restricted permissions . This has been seen in directories such as:
  • c:\users\%username% on Windows
  • / and /System on Mac
  • /var/log/ on Linux

Environment

• Carbon Black Cloud Console: All Supported Versions
  • Live Response
• Apple macOS: 10.15 and Above
• Linux: All Supported Versions
• Windows: All Supported Versions

Cause

The sensor's current behavior is to create a tmp file in the directory the command is executed. If the directory has restrictive permissions, it can cause Live Response to fail.

Resolution

​​​​​​Specify the output file in a different directory by using -o. Ex:

execfg whoami -o "Path/to/filename.log"