CB Response: Regmod wildcard query causes performance issues

Products

• Carbon Black EDR (formerly Cb Response)

Issue/Introduction

• Certain regmod searches with a wildcard times out. Some searches may succeed
• Escape characters are included in the search

Environment

• CB Response Server: 6.2.4

Cause

There is a known limitation when using a wildcard (*) and escaping characters in the same query - CB-23029

Resolution

• To work around this limitation, split the regmod path in two
  • Original query where path\ with\ space is an escaped folder with spaces
    • (regmod:registry\user\*\software\path\ with\ space\file)
  • Workaround
    • (regmod:registry\user\* AND regmod:"\software\path with space\file")

Additional Information

If the wildcard is at the very end of a query, this issue should not occur