Query to check file contents

Maybe start with something like:

Thank you I will give this a shot today and give you an update after.

one note - this is will be super slow. I wouldn't run this on more than one two machines at a time. Also, keep the target folders very constrained. Recursive iterations down the tree will cause performance problems. If you are too broad in score, the query will fail as it runs into the max time limit for query run. 

I agree, it could be limited to a few extensions (pretty crude), for example:

select path as file, line as matched_text from grep
where path in(
      select path from file where path 
      like $$Location$$ 
      and       split(path, '.',1) in ('txt', 'config', 'policy')
)
and line like '$$Data$$'

Where the variables are:

$$Data$$ = %onExec%

$$Location$$ =  'C:\ProgramData\Sophos\Management Communications System\Endpoint\%\%'

The extensions searched are txt config and policy

the problem with splitting on the . is that you can technically have .'s in a folder name. C:\This.Folder\This\Folder.This\this.txt would be a valid path and not be processed by that query. Not sure if the OP needs that sort of constraint/folder handling. 

At this stage its more about thinking up the most robust solution.

the problem with splitting on the . is that you can technically have .'s in a folder name. C:\This.Folder\This\Folder.This\this.txt would be a valid path and not be processed by that query. Not sure if the OP needs that sort of constraint/folder handling. 

At this stage its more about thinking up the most robust solution.

Hence the 'crude', what about:

select path as file, line as matched_text from grep
where path in(
      select path from file where path 
      like $$Location$$ 
      and  regex_match(path, '([0-9a-z]+)(?:[\?#]|$)', 1) in ('txt', 'config', 'policy')
)
and line like '$$Data$$'

Actually, works for files, not for paths with '.'.  Oh well, hopefully it gives OP a few ideas