I have the following rule to send all emails with suspicious attachments to a dedicated folder:
# Emails with attachments
:0
* ^Content-Type: multipart/
{
:0 B
* ^Content-Type: application/(zip|x-zip-compressed)|
^Content-Type:.*name=.*.(zip|exe|rar|rtf|docm)|
^Content-.*attachment.*name=.*.(zip|exe|rar|rtf|docm)|
^Content-.*application.octet-stream.*name=.*.(zip|exe|rar|rtf|docm)
$L/.3_my._quarantine/
}
However I just noticed that an email with a zip attachment slipped through it, and I can't figure out why (my@email and myemail contained my email and my host which I obfuscated):
X-Priority: 3 (Normal)
From: scaer47578858@myemail.com
To: "my@email.com"
<my@email.com>
Subject: Attached File
Date:Mon, 16 May 2016 17:16:47 +0530
Message-Id: <272843899191709486.0001.scaerTxNo.0051@scaerF04EF6.myemail.com>
Mime-Version: 1.0
Content-Type: multipart/mixed;
boundary="53594271E1EBE7BBDAF4BBA9"
--53594271E1EBE7BBDAF4BBA9
Content-Type: application/x-compressed;
name="my@email.com_3602848_97891076672132.zip"
Content-Transfer-Encoding: base64
Content-Disposition: attachment;
filename="my@email.com_3602848_97891076672132.zip"
AFAICS ^Content-Type:.*name=.*.(zip|exe|rar|rtf|docm) should match? Is it because of quotation marks?
برچسب:
نویسنده: استخدام کار