Splunk search for double file extension

[crisp023]

I am trying to build a use case for files that have a double file extension since these can often be the source of malware. I haven't had any success building a search string for this. Has anyone had any success building a search for locating the execution of double file extensions? Even if I can just build a search for the double file extensions, I can try to go from there. Any thoughts?

Thanks.

[jpolvino · Accepted solution]

This will pick up double extensions, and ones with more:
"\w+(\.\w+){2,}$

See https://regex101.com/r/0bZcWs/1

[crisp023]

Thanks!!!!

[richgalloway]

Searching for the regular expression \.[^\.]+\. should locate files with 2 extensions. You should search specific fields to avoid false positives.

[crisp023]

Thanks! I'll give it a try.