Is There a Way to Escape the asterisk (*) character with Query Builder/XQL Queries

[dortasa1]

Hi,

I'm trying to run the following to run the following query in Query Builder:

The query itself contains the command:

"del *.log /a /s /q /f"

I was wondering if there is a way to escape the asterisk character after the "del. " part of the command in either Query Builder or XQL?

[bbarmanroy]

Like this? https://live.paloaltonetworks.com/t5/cortex-xdr-discussions/xql-question-command-line-with-quot-to-x...

[dortasa1]

Hi Bbarmanory,
In regards to the link you have provided, I did try to put a leading slash with an asterisk (like that '\*') but I didn't get any results.

[fmoixsante]

Hi @dortasa1,

Could you please post the XQL query you are trying to execute? 

[dortasa1]

Hi Fmoixsante,
Of course, 

dataset = xdr_data
|filter os_actor_process_command_line="del *.log /a /s /q /f"

And here is the version with the escaped asterisk character:

dataset = xdr_data
|filter os_actor_process_command_line="del \*.log /a /s /q /f"