Add ext attribute to File object

[shellcromancer]

The File object currently has an attribute for the file name (e.g. svchost.exe) but having a dedicated attribute for the executable extension (e.g. exe) is useful to search on to reduce the need for more expensive wild-card searches on the name field. This would also allow for security use-cases like finding where the mime-type differs from expected file extensions.

Other security object models in usage today have this attribute as well:

• ECS: File extension
• CybOX: File_Extension

I'd suggest the type of the attribute be an optional string, and it would follow the same conventions as ECS to only get the trailing extension if there are multiple, without the prepending .: file.name of export.tar.gz has a file.extension of gz.

[zschmerber]

Nice, this is a good find.