Yea regex is case sensitive. You could try: [Aa]pp[Dd]ata\\[Ll]ocal\\[Tt]emp\\.+\.(EXE|exe)
> On Feb 11, 2017, at 6:54 AM, Tom Powers <[email protected]> wrote: > > AppData\\Local\\Temp\\.+.exe -- You received this message because you are subscribed to the Google Groups "Graylog Users" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/d/msgid/graylog2/F94D0FEF-F154-416A-BED6-B5A4B8AF31EA%40gmail.com. For more options, visit https://groups.google.com/d/optout.
