EDR: Command Line Redirection Events are Missing
search cancel

EDR: Command Line Redirection Events are Missing

book

Article ID: 291154

calendar_today

Updated On:

Products

Carbon Black EDR (formerly Cb Response)

Issue/Introduction

Why in the captured events for the following command "find / -perm -u=s -type f 2>/dev/null" the 2>/dev/null is stripped from the command line

Environment

  • EDR Server: All Supported Versions
  • EDR Sensor: All Supported Versions

Resolution

  • These redirections look like part of the command, but they are actually controlling shell behavior before the command is executed
  • When bash runs a command like this, it does this:
    1. Fork to create a new process
    2. Open a file handle to /dev/null
    3. Remap that over the stderr file descriptor
    4. Exec the command line not including any redirections
  • In this kind of syntax, the find command never sees these redirections; it’s not part of the command, it’s something bash does to the environment before running the command