EDR: How To Setup a Regmod Query

Products

• Carbon Black Hosted EDR (formerly Cb Response Cloud)

Issue/Introduction

How to setup a search for regmods that contain spaces and other special characters

Environment

• EDR: All Supported Versions

Resolution

• The leading backslash on regmod search terms are not tokenized and can be removed
• Spaces in the path can be escaped with a backslash
• Wildcards like * can be used to represent multiple locations in a path
• An example of these is

  regmod:registry\machine\software\microsoft\windows\ nt\currentversion\*\TrueTypeFont