Export (0) Print
Expand All

Using wildcard characters to refine filters

 

Applies to: Forefront Protection for Exchange

Topic Last Modified: 2010-09-22

You can use wildcard characters in order to have your filter match patterns in the file name, subject line, and sender-domain field. You can use any of the following wildcard characters to refine your filters.

NoteNote:
Wildcard syntax does not work with keyword filters.

 

Syntax Description

*

Matches any number of characters in a file name. You can use multiple asterisks. The following are some examples of usage:

  • Single: Any of these single wildcard character patterns would detect veryevil: veryevil*, very*, *il

  • Multiple: Any of these multiple wildcard character patterns would detect veryevil: V*r*v*l, *very*, *evil*

?

Matches any single character, because many malicious users insert extra characters between letters in order to spoof filters.

For example, you can filter C-O-N-T-E-S-T with the following filter: C?O?N?T?E?S?T

[set]

A list of characters and ranges, enclosed in square brackets [abcdef]. Any single character in the specified set is matched.

For example, the set is useful for creating a single rule to match when the number zero (0) is used instead of the letter o. Ozone and oz0ne can be filtered using oz[o0]ne.

[^set]

Used to exclude characters that you know are not used.

[range]

Used to indicate several possible values in a set. It is specified by a starting character, a hyphen (-), and an ending character.

For example, klez[ad-gp] would match kleza, klezd, kleze, klezf, klezg, and klezp, but not klezb or klezr.

\char

Indicates that special characters are used literally (characters are: * ? [ ] - ^ < >). The backslash is called an escape character, which indicates that a reserved control character should be taken literally as a text character.

For example, if you enter *hello*, you would usually expect to match hello anywhere in the file name. If you enter *\*hello\**, you would match *hello*. If you enter *\*hello\?\**, you would match *hello?*.

NoteNote:
You must use a \ before each special character.
 
Was this page helpful?
(1500 characters remaining)
Thank you for your feedback

Community Additions

ADD
Show:
© 2014 Microsoft