[clamav-users] FilenameRegex and case sensitivity

[Steve Basford]

On Wed, May 3, 2017 8:19 am, kionez wrote:
> Hi all,
>
>
> I wonder how I can use a case-insensitive FilenameRegex in signatures
> based on container metadata.
>
> I.E.: if I would like to match "word", "Word" and "worD" (abd so on), my
> rule will be something like:
>
> TEST.TestFilename.001:CL_TYPE_ZIP:*:[wW][oO][rR][dD]:*:*:*:*:*:*
>
>
> Is there a way to avoid this unreadable way? Something like "/word/i" ?
> :)
Foxhole_filename.cdb etc. use this sort of thing...

Sanesecurity.Foxhole.test:CL_TYPE_ZIP:*:(?i)word\.xls$:*:*:*:*:*:*

Cheers,

Steve
Twitter: @sanesecurity