Question to the rule object "Dangerous content"

[alex-schaefer]

Hello,

what means regular expression filename=.*\.{.+} in the "What" object "dangerous content" in the standard proxmox rule configuration configuration? Which kind of filenames will be matched by this regular expression?

 

[dietmar]

Attachment with a CLSID extension which may hide the real file extension.

for example:

filename="clsidfile.txt.{00020C01-0000-0000-C000-000000000046}"

- Dietmar