EDR: How To Setup a Regmod Query

[#1]

Environment

• EDR: All Supported Versions

Objective

How to setup a search for regmods that contain spaces and other special characters

Resolution

• The leading backslash on regmod search terms are not tokenized and can be removed
• Spaces in the path can be escaped with a backslash
• Wildcards like * can be used to represent multiple locations in a path
• An example of these is

  regmod:registry\machine\software\microsoft\windows\ nt\currentversion\*\TrueTypeFont

Related Content

EDR: Unable to Use Special Characters in Process Search Query
CB Response: How to search for default registry locations
CB Response: Regmod wildcard query causes performance issues
https://docs.vmware.com/en/VMware-Carbon-Black-EDR/7.6.0/CB_EDR_7.6_User_Guide.pdf