Kibana KQL Wild Card

thefield.caseless: system32*    

    will match system32\\calc.exe (* is wildcard)

thefield: "system32*"

    Not match system32\\calc.exe.(* is literal because it in quotes)

ref: https://www.elastic.co/guide/en/kibana/current/kuery-query.html