{"version":"2.1.233","anchor":"windows-suspicious-path-detection-covers-flags-and-nt-device","canonical_anchor":"windows-suspicious-path-detection-covers-flags-and-nt-device","heading":"Windows suspicious-path detection covers flags and NT device paths","tier":"notice","area":"Windows","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.233\/e\/windows-suspicious-path-detection-covers-flags-and-nt-device","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.233","markdown":"### Windows suspicious-path detection covers flags and NT device paths\n\nOn Windows, risky paths hidden inside --flag=value arguments or NT device paths are now caught.\n\n**What**\n\nOn Windows, the check that spots risky paths in commands now unwraps `--flag=value` arguments and re-checks the value, and flags NT object paths containing a `\/??\/` segment.\n\n**Details**\n\n- A normalizer collapses repeated `\\??\\` prefixes before the check runs.\n- The cygwin-style `\/c\/...` to `C:\\` conversion is now done inline rather than through a helper that was removed.\n- The sandbox path validator now uses the same shared UNC and device-path check as the rest of the detector.\n\n**Evidence**\n\n`DavWWWRoot`\n\n- Area: Windows\n- Tier: You'll notice\n- Useful: 2\/5\n- Signal: 2\/5"}