Skip to content

Commit 36430eb

Browse files
committed
fix(ps): Initialize process name on internal event arrival
1 parent 18c7d00 commit 36430eb

File tree

1 file changed

+1
-0
lines changed

1 file changed

+1
-0
lines changed

pkg/ps/snapshotter_windows.go

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -369,6 +369,7 @@ func (s *snapshotter) newProcState(pid, ppid uint32, e *event.Event) (*pstypes.P
369369
PID: pid,
370370
Ppid: ppid,
371371
Exe: e.GetParamAsString(params.Exe),
372+
Name: filepath.Base(e.GetParamAsString(params.Exe)),
372373
TokenIntegrityLevel: e.GetParamAsString(params.ProcessIntegrityLevel),
373374
TokenElevationType: e.GetParamAsString(params.ProcessTokenElevationType),
374375
IsTokenElevated: e.Params.TryGetBool(params.ProcessTokenIsElevated),

0 commit comments

Comments
 (0)