Mailu/core/rspamd/conf/composites.conf

OLETOOLS_MACRO_MRAPTOR {
    expression = "(OLETOOLS_A & OLETOOLS_W) | (OLETOOLS_A & OLETOOLS_X) | (OLETOOLS_W & OLETOOLS_X)";
    message = "Rejected (malicious macro - mraptor)";
    policy = "leave";
    score = 20.0;
}
OLETOOLS_MACRO_SUSPICIOUS {
    expression = "OLETOOLS_SUSPICIOUS | OLETOOLS_VBASTOMP";
    message = "Rejected (malicious macro)";
    policy = "leave";
    score = 20.0;
}