Proximity Operator

  • Use the proximity operator to search for multiple artifacts that can appear under a WildFire Analysis category of a sample. Enter two or more artifacts in the value field of the search condition.
    Example:
    The search Registry ActivityproximityHKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\AppData ueepd-a.exereturns a sample that has both values in at least one of its registry activities:
    proximity-search-example-1.png
  • The order in which the strings are entered does not affect the search results.
    Example:
    The search Registry Activityproximityueepd-a.exe HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\AppData returns the same results as the previous example.
  • Searches with the proximity operator are not case-sensitive.
  • You can enter partial strings in a proximity search, but you must type the full strings that appear between any special characters that are not letters or numbers (e.g. period, backslash, hyphen, space, @ symbol) for accurate matches.
    Example:
    The search Registry ActivityproximityHKCU\Software\Microsoft\Windows\CurrentVersion ueepd-a.exe returns the following results:
    proximity-search-example-2.png
    The search Registry ActivityproximityHKCU\Software\Microsoft\Windows\Current ueepd-a.exe will not return the search results above.

Related Documentation