When Carbon Black App Control processes a rule, file paths in a process field undergo several automatic path conversions if they contain certain symbols.

The following symbols trigger automatic path conversions.

  • Any path that ends with a slash has the * wildcard added at the end of the path.
  • Any path that has no slash or drive letter has *\ added at the beginning of the path
  • Drive letters may be used in a path as long as they are for local fixed volumes. Mapped drive letters must not be used because there is no guarantee that the mapping exists on all computers.
  • The string *:\ applies to all attached storage volumes except for floppy disks and CD-ROMs.