A library malware hunt looks for a rare mutex string. The analyst uses a loose substring with wildcards and the search scans far more events than expected. What is the efficient way to seek that indicator?
Select an answer to reveal the explanation.
Short Explanation
A rare mutex is a unique library catalog number — ask for that exact token. TERM() or a quoted term lets the index jump to it; wrapping it in asterisks makes the clerk read every shelf.
Full Explanation
Exact indexed tokens can be sought efficiently with TERM() or a quoted term. Loose substring or leading-wildcard patterns on a malware mutex force broader scans and defeat index lookup. transaction of all library endpoints and verbose rex on index=* are costlier still. For rare security strings, search the term the way it was indexed.