EDR: How To Setup a Regmod Query
search cancel

EDR: How To Setup a Regmod Query

book

Article ID: 289416

calendar_today

Updated On:

Products

Carbon Black Hosted EDR (formerly Cb Response Cloud)

Issue/Introduction

How to setup a search for regmods that contain spaces and other special characters

Environment

  • EDR: All Supported Versions

Resolution

  • The leading backslash on regmod search terms are not tokenized and can be removed
  • Spaces in the path can be escaped with a backslash
  • Wildcards like * can be used to represent multiple locations in a path
  • An example of these is
    regmod:registry\machine\software\microsoft\windows\ nt\currentversion\*\TrueTypeFont