Block encrypted document files

[Peter Lemieux]

Usually these files include the password in the body of the message.  You 
could add a spamassassin rule that add points to messages with "password" or 
whatever is used in the body of the message.

Peter



On 10/05/2016 10:16 AM, Tiago Meireles wrote:
> We have been receiving spam with malicious content in the form of password
> protected .doc and .doct files.
>
> I have created a filename.rules.conf rule to block .doct but how can I
> handle the .doc files? I've tried searching to block this in mailscanner and
> in clamav but did not see anything promising.
>
> Thanks,
> Tiago
>
>
>