EDR: Command Line Redirection Events are Missing

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

Why in the captured events for the following command "find / -perm -u=s -type f 2>/dev/null" the 2>/dev/null is stripped from the command line

Environment

• EDR Server: All Supported Versions
• EDR Sensor: All Supported Versions

Resolution

• These redirections look like part of the command, but they are actually controlling shell behavior before the command is executed
• When bash runs a command like this, it does this:
  1. Fork to create a new process
  2. Open a file handle to /dev/null
  3. Remap that over the stderr file descriptor
  4. Exec the command line not including any redirections

• In this kind of syntax, the find command never sees these redirections; it’s not part of the command, it’s something bash does to the environment before running the command