redcanaryco / surveyor

A cross-platform baselining, threat hunting, and attack surface analysis tool for security teams.
MIT License
170 stars 59 forks source link

[BUG] OSX process names with spaces #3

Closed ktneely closed 1 year ago

ktneely commented 7 years ago

Processes on OSX with a space in their name get missed in the search. Doing a quick test with the API, I see that if I enclose the process in quotes, I get results len( CbResponseAPI().select(Process).where('process_name:"Google Chrome"'))

whereas no quotes like: len(CbResponseAPI().select(Process).where('process_name:Google Chrome')) returns 0 results.

It seems the JSON file does not like the additional quotes, and I could not find the proper place in the script to attempt to encapsulate the process name with some additional formatting.