Motivated by applications in cybersecurity such as finding meaningful sequences of malware-related events buried inside large amounts of computer log data, we introduce the ``planted path'' problem and propose an algorithm to find fuzzy matchings between two trees. This algorithm can be used as a ``building block'' for more complicated workflows. We demonstrate usefulness of a few of such workflows in mining synthetically generated data as well as real-world ACME cybersecurity datasets.