[BUG] Common Ransomware Extensions - Regex Matching Double File Extension

[KyleSchuette]

Describe the bug

The regex for "Detection: Common Ransomware Extensions" will never match on entries in the lookup, ransomware_extensions_lookup, that contain "double" file extensions. That is, patterns with more than one segment after the first period. Currently this only affects the following:

Line 16: *.Where_my_files.txt, Apocalypse
Line 24: *.bart.zip, Bart

Consider implementing the following regex to match on these edge cases:
| rex field=file_name "(?<file_extension>(\.[^\.]+{1,2})$"

Expected behavior

The expected behavior is for this detection to match any file extension within the associated lookup.

[nasbench]

Hey @KyleSchuette thanks for the suggestion and catching this. The regex has been updated along with updates to the lookup itself to remove some duplicate and overlapping values. The changes are tracked in PR #3705.