# US 12,001,567 B1 · Protections against command line security vulnerabilities > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,001,567 B1 - Document ID: US12001567B1 - Status: Granted - Kind: B1 - Application number: 18/514,199 - Filed: 2023-11-20 - Granted: 2024-06-04 - Earliest claimed: 2023-11-20 - Assignees: CyberArk Software Ltd. - Applicants: CyberArk Software Ltd. - Inventors: Eyal Rosner; Hod Sinay; Yonatan Volkov - Web page: https://patentgrep.com/patent/US12001567B1 ## CPC - G06F 21/60: Protecting data - G06F 21/54: by adding security routines or objects to programs - G06F 21/78: to assure secure storage of data (address-based protection against unauthorised use of memory G06F12/14; record carriers for use with machines and with at least a part designed to carry digital markings G06K19/00) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Systems, methods, and apparatuses are disclosed for securing the use of command line entries. Techniques may include invoking, by a main process, a secondary process in a computing environment in a suspended mode and providing one or more placeholder command line entry to the secondary process. Techniques may further include retrieving at least one secret by the main process and storing an operable command line entry in a memory location associated with the secondary process, wherein the one or more placeholder command line entry is nullified, wherein the secondary process is configured to process the operable command line entry and use the at least one secret. ## Claims ### Claim 1 A computer-implemented method for securing the use of command line entries, the method comprising: invoking, by a main process, a secondary process in a computing environment in a suspended mode; providing one or more placeholder command line entry to the secondary process; retrieving at least one secret by the main process; and storing an operable command line entry in a memory location associated with the secondary process, wherein the one or more placeholder command line entry is nullified; and wherein the secondary process is configured to process the operable command line entry and use the at least one secret. ### Claim 2 (depends on 1) The computer-implemented method of claim 1, wherein the memory location associated with the secondary process is a process environment block. ### Claim 3 (depends on 2) The computer-implemented method of claim 2, further comprising deleting the operable command line entry from the process environment block after the secret is used. ### Claim 4 (depends on 1) The computer-implemented method of claim 1, wherein the operable command line entry is accessed from one or more stack arguments located in a call stack associated with a thread in the secondary process. ### Claim 5 (depends on 1) The computer-implemented method of claim 1, wherein the operable command line entry is located using an operating system application programming interface. ### Claim 6 (depends on 1) The computer-implemented method of claim 1, wherein the operable command line entry is not made available to an auditing tool. ### Claim 7 (depends on 1) The computer-implemented method of claim 1, wherein the one or more placeholder command line entry is made available to an auditing tool. ### Claim 8 (depends on 1) The computer-implemented method of claim 1, wherein the at least one secret is retrieved from a secure secret storage location. ### Claim 9 (depends on 1) The computer-implemented method of claim 1, wherein the at least one secret is obtained from user input prior to the execution of the secondary process. ### Claim 10 (depends on 1) The computer-implemented method of claim 1, wherein the secondary process is resumed after the operable command line entry is stored in the memory location associated with the secondary process. ### Claim 11 A non-transitory computer readable medium including instructions that, when executed by at least one processor, cause the at least one processor to perform operations for securing the use of command line entries, the operations comprising: invoking, by a main process, a secondary process in a computing environment in a suspended mode; providing one or more placeholder command line entry to the secondary process; retrieving at least one secret by the main process; and storing an operable command line entry in a memory location associated with the secondary process, wherein the one or more placeholder command line entry is nullified; wherein the secondary process is configured to process the operable command line entry and use the at least one secret. ### Claim 12 (depends on 11) The non-transitory computer readable medium of claim 11, wherein the operable command line entry includes the at least one secret. ### Claim 13 (depends on 11) The non-transitory computer readable medium of claim 11, wherein the operable command line entry is configured to assert the secret to access a protected asset. ### Claim 14 (depends on 11) The non-transitory computer readable medium of claim 11, wherein the one or more placeholder command line entry has a size that is equal to or larger than a size of the operable command line entry. ### Claim 15 (depends on 11) The non-transitory computer readable medium of claim 11, wherein the operations further comprise resuming the secondary process. ### Claim 16 (depends on 11) The non-transitory computer readable medium of claim 11, wherein nullifying the one or more placeholder command line entry comprises deleting the one or more placeholder command line entry. ### Claim 17 (depends on 11) The non-transitory computer readable medium of claim 11, wherein nullifying the one or more placeholder command line entry comprises overwriting the one or more placeholder command line entry with the operable command line entry. ### Claim 18 (depends on 11) The non-transitory computer readable medium of claim 11, wherein the secondary process is suspended immediately upon its initial execution. ### Claim 19 (depends on 11) The non-transitory computer readable medium of claim 11, wherein the secondary process is suspended before it processes any command line entries. ### Claim 20 (depends on 11) The non-transitory computer readable medium of claim 11, wherein the operations further comprise deleting the operable command line entry from the memory location associated with the secondary process after the secret is used.