action_process_image_command_line Filter Issue

[a2123k1]

Hi, I'm trying to build a query that would check for reg.exe launches. This is well and good, but the moment I add a filter action_process_image_command_line = "reg save" nothing appears, even though it was part of the initial result for reg.exe. When I checked the schema, action_process_image_command_line is a string, so I don't think my query was wrong. Is anyone else having the same issue?

config case_sensitive = false
| dataset = xdr_data
| filter agent_hostname = "hostname"
| filter event_type = ENUM.PROCESS and event_sub_type in (ENUM.PROCESS_START, ENUM.PROCESS_STOP) and action_process_image_name = "reg.exe*"
| filter action_process_image_command_line = "reg save"
| fields agent_hostname, actor_effective_username, action_process_image_command_line, action_process_image_name, actor_process_command_line, *command_line*

  
Unfiltered
Unfiltered

Filtered

[A.Elzedy]

Hi @a2123k1 ,

Typically, action_process_image_command_line would include the full command, i.e "reg save HKLM\\HARDWARE \"C:\\Program Files\...."

I would recommend shifting to contains instead

| filter action_process_image_command_line contains "reg save"

or leverage regex to ensure it starts with reg save

| filter action_process_image_command_line ~= "(^reg save(.*)$)"

[a2123k1]

Thanks for the suggestion, those didn't work either.