> On Feb 18, 2016, at 8:14 PM, Steven Morgan <smor...@sourcefire.com> wrote: > > cdb signatures use a regex library known as "Henry Spencer's regular > expressions." Googling documentation for that should give what you want.
Thank you for the information. I searched out for that and found documentation, but am not able to get the desired outcome. Henry Spencer’s regular expressions are supposed to be POSIX compliment and "\s" is valid for space but I cannot get it to work. For example I am able to use "^New.Doc.*" to match for "New Doc.xls" but "^New\sDoc.*" or "^New Doc.*" does not. Thanks -- Mehmet Avcioglu meh...@activecom.net _______________________________________________ Help us build a comprehensive ClamAV guide: https://github.com/vrtadmin/clamav-faq http://www.clamav.net/contact.html#ml
