When Carbon Black App Control processes a rule, file paths in a process field undergo several automatic path conversions if they contain certain symbols.
The following symbols trigger automatic path conversions.
- Any path that ends with a slash has the
*wildcard added at the end of the path.
- Any path that has no slash or drive letter has
*\added at the beginning of the path
- Drive letters may be used in a path as long as they are for local fixed volumes. Mapped drive letters must not be used because there is no guarantee that the mapping exists on all computers.
- The string
*:\applies to all attached storage volumes except for floppy disks and CD-ROMs.