1
0
mirror of https://github.com/Mailu/Mailu.git synced 2024-12-16 10:59:53 +02:00
Mailu/core/rspamd/conf/composites.conf
Florent Daigniere 709023ab5a dimitri said "block it"
So let's block any macro with AUTOEXEC
2022-11-24 12:04:03 +01:00

13 lines
417 B
Plaintext

OLETOOLS_MACRO_MRAPTOR {
expression = "(OLETOOLS_A & OLETOOLS_W) | (OLETOOLS_A & OLETOOLS_X) | (OLETOOLS_W & OLETOOLS_X)";
message = "Rejected (malicious macro - mraptor)";
policy = "leave";
score = 20.0;
}
OLETOOLS_MACRO_SUSPICIOUS {
expression = "OLETOOLS_SUSPICIOUS | OLETOOLS_VBASTOMP | OLETOOLS_AUTOEXEC";
message = "Rejected (malicious macro)";
policy = "leave";
score = 20.0;
}