Wildcard pattern not working for trusted applications

Elastic Stack Kibana
1

Hi

I was trying to add a trusted application to a policy. Adding full path works but the moment I change it to a wildcard pattern, it stops working
Eg: C:\Users\IEUser\Desktop\app.exe works fine but C:\Users\*\Desktop\app.exe or C:\Users\*\*\app.exe or C:\Users\*\app.exe doesn't work as expected.

Here is the sample added

**OS IS Windows**
AND process.executable.caseless MATCHES C:\Users\*\Desktop\app.exe

I followed this document. Is there something I'm doing wrong with adding the application?

2

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.