Automatic Path Conversions

When Carbon Black App Control processes a rule, file paths in a process field undergo several automatic path conversions if they contain certain symbols.

The following symbols trigger automatic path conversions.

• Any path that ends with a slash has the * wildcard added at the end of the path.
• Any path that has no slash or drive letter has *\ added at the beginning of the path
• Drive letters may be used in a path as long as they are for local fixed volumes. Mapped drive letters must not be used because there is no guarantee that the mapping exists on all computers.
• The string *:\ applies to all attached storage volumes except for floppy disks and CD-ROMs.