I have the following rule to send all emails with suspicious attachments to a dedicated folder:
# Emails with attachments
:0
* ^Content-Type: multipart/
{
:0 B
* ^Content-Type: application/(zip|x-zip-compressed)|
^Content-Type:.*name=.*.(zip|exe|rar|rtf|docm)|
^Content-.*attachment.*name=.*.(zip|exe|rar|rtf|docm)|
^Content-.*application.octet-stream.*name=.*.(zip|exe|rar|rtf|docm)
$L/.3_my._quarantine/
}
However I just noticed that an email with a zip attachment slipped through it, and I can't figure out why (my@email and myemail contained my email and my host which I obfuscated):
X-Priority: 3 (Normal)
From: [email protected]
To: "[email protected]"
<[email protected]>
Subject: Attached File
Date:Mon, 16 May 2016 17:16:47 +0530
Message-Id: <272843899191709486.0001.scannerTxNo.0051@scannerF04EF6.myemail.com>
Mime-Version: 1.0
Content-Type: multipart/mixed;
boundary="53594271E1EBE7BBDAF4BBA9"
--53594271E1EBE7BBDAF4BBA9
Content-Type: application/x-compressed;
name="[email protected]_3602848_97891076672132.zip"
Content-Transfer-Encoding: base64
Content-Disposition: attachment;
filename="[email protected]_3602848_97891076672132.zip"
AFAICS ^Content-Type:.*name=.*.(zip|exe|rar|rtf|docm) should match? Is it because of quotation marks?
Recent Questions...
ما را در سایت Recent Questions دنبال میکنید
برچسب:
نویسنده: استخدام کار
بازدید: 215
تاريخ: دوشنبه
27 ارديبهشت
1395 ساعت: 20:05