# Search error and escaping characters
**URL:** https://discuss.elastic.co/t/search-error-and-escaping-characters/344935
**Category:** Kibana
**Created:** [October 12, 2023, 3:06pm UTC](https://discuss.elastic.co/t/search-error-and-escaping-characters/344935 "2023-10-12T15:06:26Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@Lewis030](https://discuss.elastic.co/u/Lewis030)
#### Post date: [October 12, 2023, 3:06pm UTC](https://discuss.elastic.co/t/search-error-and-escaping-characters/344935/1 "2023-10-12T15:06:26Z")
Hello there, i'm trying to play around with a rule to search for instances of the Sticky Key being abused in Windows.
The output below has been created from converting a SIGMA rule:
process where (event.category : "process" and process.command\_line : "\*copy _" and process.command\_line : "_/y \*" and process.command\_line : "_C:\windows\system32\cmd.exe C:\windows\system32\sethc.exe_")
Whenever i try this in Kibana i get a lot of errors. I understand after reading that i need to escape certain characters. Please can someone advise how to make this work. Also do i need the process where at the beginning (i don't think i do) ?
Hopefully someone can help as i intend to create and convert a few more SIGMA rules to test.
Thanks
---
### Author:  [@Lewis030](https://discuss.elastic.co/u/Lewis030)
#### Post date: [October 13, 2023, 5:59am UTC](https://discuss.elastic.co/t/search-error-and-escaping-characters/344935/2 "2023-10-13T05:59:07Z")
I may have worked it out but have no way of testing.
process.command\_line : ("C:\windows\system32\cmd.exe C:\windows\system32\sethc.exe" AND _copy_ AND _/y_) AND event.category : "process"
Please could someone take a look and tell me what they think.
Thanks
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [November 10, 2023, 5:59am UTC](https://discuss.elastic.co/t/search-error-and-escaping-characters/344935/3 "2023-11-10T05:59:08Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.