Query for shadow objects is as following, in Query playground (simplified and anonymized):
The query is meant to match shadows like:
but is also matches:
which is bad.
The issue is that substring is translated to "like" and the underscode is being interpreted by SQL engine (MS SQL in our case).
One possible workaround may be enclosing underscode in , but it's too late to test that in my environment (the groups are already gone).