Using wildcard characters to refine filters


Applies to: Forefront Protection for Exchange

Topic Last Modified: 2010-09-22

You can use wildcard characters in order to have your filter match patterns in the file name, subject line, and sender-domain field. You can use any of the following wildcard characters to refine your filters.

Wildcard syntax does not work with keyword filters.


Syntax Description


Matches any number of characters in a file name. You can use multiple asterisks. The following are some examples of usage:

  • Single: Any of these single wildcard character patterns would detect veryevil: veryevil*, very*, *il

  • Multiple: Any of these multiple wildcard character patterns would detect veryevil: V*r*v*l, *very*, *evil*


Matches any single character, because many malicious users insert extra characters between letters in order to spoof filters.

For example, you can filter C-O-N-T-E-S-T with the following filter: C?O?N?T?E?S?T


A list of characters and ranges, enclosed in square brackets [abcdef]. Any single character in the specified set is matched.

For example, the set is useful for creating a single rule to match when the number zero (0) is used instead of the letter o. Ozone and oz0ne can be filtered using oz[o0]ne.


Used to exclude characters that you know are not used.


Used to indicate several possible values in a set. It is specified by a starting character, a hyphen (-), and an ending character.

For example, klez[ad-gp] would match kleza, klezd, kleze, klezf, klezg, and klezp, but not klezb or klezr.


Indicates that special characters are used literally (characters are: * ? [ ] - ^ < >). The backslash is called an escape character, which indicates that a reserved control character should be taken literally as a text character.

For example, if you enter *hello*, you would usually expect to match hello anywhere in the file name. If you enter *\*hello\**, you would match *hello*. If you enter *\*hello\?\**, you would match *hello?*.

You must use a \ before each special character.

Community Additions