Is there a easy way to check double file extension?

Rules
1

hello, I want to check the attachment in the mail whether have the double file extension，
like jpg.exe pdf.exe …
I wrote rules like below,

alert smtp any any -> any any(msg:"double file extension detected"; fileext:"aaa|2e|exe";classtype:misc-attack;sid:1; rev:1)
alert smtp any any -> any any(msg:"double file extension detected"; fileext:"bbb|2e|exe";classtype:misc-attack;sid:2; rev:1)
alert smtp any any -> any any(msg:"double file extension detected"; fileext:"ccc|2e|exe";classtype:misc-attack;sid:3; rev:1)

Obviously, it’s troublesome.
Is there a easy way to implement it？

2

Do you want only one rule ?
Then maybe you should have a pcre on the file extension ?

3

Hmm, but AFAICS fileext is not a buffer, so pcre won’t work I guess? Looks like it wants a fixed string to match.

4

So file.name should be used :wink:

5

Duh, of course :smiley: My bad. Couldn’t find that in the documentation: 6.14. File Keywords — Suricata 7.0.0-dev documentation

I guess one could then indeed to something like

alert smtp any any -> any any (msg:"test"; flow:to_client; file.name; content:"|2e|exe"; endswith; fast_pattern; file.name; pcre:"/(aaa|bbb)\.exe$/i"; sid: 42;)