Community Patterns

Community Library Entry

0

Regular Expression
Created·2023-05-25 15:14
Flavor·PCRE2 (PHP)

/
^((?![\\\/:\*"\<\>\|]+).)*\.((?![\\\/:\*"\<\>\|]+).)+\.((?![\\\/:\*"\<\>\|]+).)+$
/
gm
Open regex in editor

Description

This can be used for threat hunting. It will look for valid file names that have a double extension that can be used to trick people. Ex: Invoice.pdf.exe

Submitted by Todd A Danko