title: Yara Rule - Regex - Matching Wildcard
body: <p>Regex has always been somewhat of a black box for me.</p>
  
  <p>I believe I need to use some regex to write some of the following yara rules. Yara rules use regex in order to match execution of particular binaries within malware. Knowledge of this is not necessary to answer the question, simply that they use regex.</p>
  
  <p>I've got some basic rules down such as detection of the following programs:</p>
  
  <pre><code>    C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\cdb.exe
      C:\Program Files (x86)\Windows Kits\10\Debuggers\x86\cdb.exe
  </code></pre>
  
  <p>With the following rules</p>
  
  <pre><code>    cuckoo.filesystem.file_access(/C\:\\Program\ Files\ \(x86\)\\Windows\ Kits\\10\\Debuggers\\x64\\cdb.exe/) or
      cuckoo.filesystem.file_access(/C\:\\Program\ Files\ \(x86\)\\Windows\ Kits\\10\\Debuggers\\x86\\cdb.exe/) or
  </code></pre>
  
  <p>But if i'm trying to detect execution of the following binaries, that being any file that matches the pattern of beginning with the C:\Program Files\ or C:\Program Files\Microsoft Office and ends with excel.exe</p>
  
  <p>Something like the following?</p>
  
  <pre><code>    cuckoo.filesystem.file_access(/C\:\\*\\Excel.exe/) or
  </code></pre>
  
  <p>What else needs detection is dnx.exe, perhaps something like this would work:</p>
  
  <pre><code>    cuckoo.filesystem.file_access(/C\:\\*\\dnx.exe/) or
  </code></pre>
  
  <p>Also need to detect stuff like:</p>
  
  <pre><code>    C:\Program Files\Microsoft Office\root\client\appvlp.exe
  </code></pre>
  
  <p>Where the root user may be any specific user and would ideally be replaced with a wildcard.</p>