How to Block Files with Double Extensions in MetaDefender Core?

Overview

By default, Windows may hide the extension of a file, hence an executable “document.pdf.exe” may be displayed as “document.pdf”, potentially mislead users to click on it.

This article describes how to configure MetaDefender Core to block files with double extensions using a regular expression blocklist filter.

Steps to Configure

To block files with double extensions, follow these steps:

1. In your MetaDefender Core workflow, set up a regular expression rule in the Blocklist settings.
2. Add the following regex under “Blocklist by filename”: .\w+.\w+$

• \.\w+ — matches the first extension, with a preceding dot (.) and any one or more characters (e.g., .pdf, .doc, etc.)
• \. — matches the dot before the second extension
• \w+ — matches another extension (again, one or more characters)
• $ — ensures the match is at the end of the string

Verify the Change

1. Scan a file using the configured workflow.
2. Adjust the regex as needed. Consider the following:

Since the rule above is broad, it might block legitimate files, such as archive files “archive.tar.gz” - technically 2 extensions.

You may consider modifying it to block only double extensions files ending in executable types: .\w+.(exe|bat|cmd|scr|pif)$

• \.\w+ — matches the first extension (e.g., .pdf, .doc, etc.)
• \. — matches the dot before the second extension
• (exe|bat|cmd|scr|pif) — matches only known executable extensions
• $ — ensures the match is at the end of the string

This matches:

• document.pdf.exe
• image.jpg.scr
• report.doc.bat

But does not match legitimate files such as:

• file.exe
• archive.tar.gz
• notes.txt