regular expression in the "Who Object - Dangerous Content - Match Archive Filename" field

turpn11

New Member
Mar 3, 2025
2
0
1
Good afternoon. How do I correctly write a regular expression in the "Who Object - Dangerous Content - Match Archive Filename" field?
I need it to check attachments inside RAR archives for the presence of files such as .exe, .cmd, .bat, and similar.
Currently, every solution I know also ends up blocking .xlsx and .xls files, which is not desirable.

For example, this solution block all xls, xlsx files:
.*\.(exe|vbs|pif|lnk|shs|shb|scr|iso|msi|chm|url|)
 
Last edited:
Error: (exe|url|) will match even a dot without an extension (e.g. file.).
Fix: remove the last |.