The new docs.trellix.com features a modernized UI and AI-powered conversational search. Content is currently available in English, with additional languages launching in early November 2026. We hope you enjoy the updated experience.

Wildcards

Prev Next

You can use wildcards for section values in Expert Rules.

Note

Exploit Prevention is not supported in the ARM architecture.

Wildcard character

Represents

? (question mark)

A single character.

* (one asterisk)

Multiple characters, including / and \.

Note

For paths and addresses, use ** (2 asterisks) to include / and \. Use * (one asterisk) to exclude / and \.

& (ampersand)

Multiple characters except / and \.

Use & to match the root-level contents of a folder, but no subfolders.

For example:

Include
"C:\test\\&.txt"

! (exclamation point)

Wildcard escape.

For example:

Include
"C:\test\\yahoo!.txt"