Block encrypted document files

[Tiago Meireles]

Good call. Anyone else see these types of emails? What other terms do they
use?

Current list is password, pwd, access key, and key.

-----Original Message-----
From: MailScanner
[mailto:mailscanner-bounces+tmeireles=electroind.com at lists.mailscanner.info]
On Behalf Of Peter Lemieux
Sent: Wednesday, October 5, 2016 10:23 AM
To: MailScanner Discussion
Subject: Re: Block encrypted document files

Usually these files include the password in the body of the message.  You
could add a spamassassin rule that add points to messages with "password" or
whatever is used in the body of the message.

Peter



On 10/05/2016 10:16 AM, Tiago Meireles wrote:
> We have been receiving spam with malicious content in the form of 
> password protected .doc and .doct files.
>
> I have created a filename.rules.conf rule to block .doct but how can I 
> handle the .doc files? I've tried searching to block this in 
> mailscanner and in clamav but did not see anything promising.
>
> Thanks,
> Tiago
>
>
>


--
MailScanner mailing list
mailscanner at lists.mailscanner.info
http://lists.mailscanner.info/mailman/listinfo/mailscanner