can you block attachments based on Regex matches like you do with keywords

Question

we have recently recived a bunch of emails that have attachments that are not in themselves malicious, but contain links to malicious sites with downloads, the files dont have the same names, and or links, but they all have filenames that match one of the regex rules that i was using to block them when they had the filename as subject lines. 
 
 blocking each by name would take forever and be a game of wack-a-mole, and all are pdfs so the mount of false positives by blocking the entire attachment type is unsustainable. 
 Is there any way to match extension name by regex?

Red_Warrior · Answer

Hi Enviable, 
 There a re a couple of things to consider with this request. 
 #1 workstations should always have update ep/av clients as often malware / attachments may be encrypted or may be unknown at the split second they hit your gateway. So multiple levels of AV is always recommended. 
 #2 there is a feature called "time of click" you may wish to have a look at.. in short it will scan email for rfc links in the email.. it will then re-write the address so that the link is proxied through the appliance. this allows the labs team to block domains in addition to av/as rules. 
 #3 the appliance actually doesn't care what you call a file.. It will use true-type scanning to scan the file. So theirs no way you could scan for a file name.. you would simply block the file type.. ie: *.ole2 .. *.zip or similar.. Just be careful because the appliance will match that against every file type that is contained within the file.. for example you may have test.pdf but the file its self would contain .txt .jpg .pdf and other elements. 
 that been said you can make rules based on subject.. just enable the advanced tick box on the first page of a data control or additional policy.. there is a tab for regular expressions.. the format MUST be fully qualified .. and uses email globs and perl regex.. for example \b test \b have a look at something like this https://www.regular-expressions.info/numericranges.html 
 NOTE: never set a rule to discard until its proven, there is no recycle-bin.. so if your rule isnt working exactly as you would like .. you may get FP/FN 
 #4 the very best option you have is to install the 'submit spam' button in outlook and submit the samples as spam to is-spam@labs.sophos.com emails will be tabulated and anything that is malicious or contains malicious links would be dropped by AS rules. (if you dont have the plug-in, create a new message and drag and drop all of the spam as .eml attachments , fire that off, just make sure your excluded from outbound spam checking if you have it enabled) 
 
 in addition, make sure the appliance has fast dns, check your firewall rules and ensure any sxl lockups are not been blocked.. and double check your AS rules via my kb here : community.sophos.com/.../120802 
 
 cheers