Mailu/core/rspamd/conf/composites.conf

{% if SCAN_MACROS == 'True' %}
OLETOOLS_MACRO_MRAPTOR {
    expression = "(OLETOOLS_A & OLETOOLS_W) | (OLETOOLS_A & OLETOOLS_X) | (OLETOOLS_W & OLETOOLS_X)";
    message = "Rejected (malicious macro - mraptor)";
    policy = "leave";
    score = 20.0;
}
OLETOOLS_MACRO_SUSPICIOUS {
    expression = "OLETOOLS_FLAG | OLETOOLS_VBASTOMP | OLETOOLS_A";
    message = "Rejected (malicious macro)";
    policy = "leave";
    score = 20.0;
}
{% endif %}