The new docs.trellix.com offers a modernized UI and AI-powered features like conversational searches. Content is currently available only in English. Other languages will be available in mid-October 2026. We hope you enjoy the new experience.

Wildcards

Prev Next

You can use wildcards for section values in Expert Rules.

Note

Exploit Prevention is not supported in the ARM architecture.

Wildcard character

Represents

? (question mark)

A single character.

* (one asterisk)

Multiple characters, including / and \.

Note

For paths and addresses, use ** (2 asterisks) to include / and \. Use * (one asterisk) to exclude / and \.

& (ampersand)

Multiple characters except / and \.

Use & to match the root-level contents of a folder, but no subfolders.

For example:

Include
"C:\test\\&.txt"

! (exclamation point)

Wildcard escape.

For example:

Include
"C:\test\\yahoo!.txt"