diff --git a/data/web/inc/presets/sieve/sieve_1.yml b/data/web/inc/presets/sieve/sieve_1.yml
index e7fa8c846e..45e0eb46ca 100644
--- a/data/web/inc/presets/sieve/sieve_1.yml
+++ b/data/web/inc/presets/sieve/sieve_1.yml
@@ -1,7 +1,7 @@
 headline: lang.sieve_preset_1
 content: |
   require ["reject","body","regex"];
-  if anyof (body :raw :regex ["filename=.*\.doc","filename=.*\.exe","filename=.*\.moo"]) {
+  if anyof (body :raw :regex ["filename=\".*\\.(doc|exe|moo)\""]) {
     reject text:
   doc, exe and moo are dangerous file extensions.
   Why would you do that? I am a sad cow.