#include // created 03/05/2017 09:23
> Foxhole_filename.cdb etc. use this sort of thing...
>
> Sanesecurity.Foxhole.test:CL_TYPE_ZIP:*:(?i)word\.xls$:*:*:*:*:*:*
Ooops,
before asking I read carefully the manual (signatures.pdf) and peeked in
other CDB rules, but I did not notice it.. sorry
On Wed, May 3, 2017 8:19 am, kionez wrote:
> Hi all,
>
>
> I wonder how I can use a case-insensitive FilenameRegex in signatures
> based on container metadata.
>
> I.E.: if I would like to match "word", "Word" and "worD" (abd so on), my
> rule will be something like:
>
> TEST.TestFilename.001:CL_T
Hi all,
I wonder how I can use a case-insensitive FilenameRegex in signatures
based on container metadata.
I.E.: if I would like to match "word", "Word" and "worD" (abd so on), my
rule will be something like:
TEST.TestFilename.001:CL_TYPE_ZIP:*:[wW][oO][rR][dD]:*:*:*:*:*:*
Is there a way to avo
