Hello,

As the title suggests I'm trying to match look for the string "%27" in the message field for some IIS events but I'm unable to match that specific sequence of characters. I've tried msg:%27, msg:"%27", msg:\%27. All three of those pull in events that just have "27" in the message instead of %27.

I've also tried msg:/\%27/ with no luck. Can anyone provide guidance?

Thanks,
Eric