I've ran into a strange issue and I'm wondering if anyone else has seen this behavior.
For the purpose of tracking ExtraDAT adoption, I have a couple of queries to check for particular strings that are in that file. For example, if an ExtraDAT is released for virus.vbs, I would change the criteria in my query to show Extradat.names contains (insert virus name here).
The following query:
Used to return something like this....
In my 5.3 environment, I'm starting to see this...
As you can see, this has effectually broken my query as we are no longer searching for a static value. Has anyone else ran into this?