Hi Bret...small world... :)
^content-(disposition\|type):.*name[[:blank:]]*=[[:blank:]]*"{0,1}[^/\:*?"<>|
]*\.(ade\|adp\|app\|bas\|bat\|chm\|cmd\|cpl\|crt\|csh\|fxp\|hlp\|hta\|inf\|ins\|isp\|js\|jse\|ksh\|mda\|mde\|mdt\|mdw\|mdz\|msc\|msi\|msp\|mst\|pcd\|pif\|prf\|prg\|reg\|scf\|scr\|sct\|shb\|shs\|vb\|vbe\|vbs\|wsc\|wsf\|wsh\|xsl)\b
This is what I use with the RegEx filter and would need to be adapted for the
SA. Note that the "\|" would probably need to be changed to "|". Also the
[[:blank:]] is (I think) equivalent to a [ \t]
Therefore, the proper translation would be:
^content-(disposition|type):.*name[ \t]*=[
\t]*"{0,1}[^/\:*?"<>|
]*\.(ade|adp|app|bas|bat|chm|cmd|cpl|crt|csh|exe|fxp|hlp|hta|inf|ins|isp|js|jse|ksh|mda|mde|mdt|mdw|mdz|msc|msi|msp|mst|pcd|pif|prf|prg|reg|scf|scr|sct|shb|shs|vb|vbe|vbs|wsc|wsf|wsh|xsl)\b
(but double check me here)
Also, note that it is easy to add/remove particular extensions as desired.
Rob McEwen
