Closed filippocarletti closed 4 years ago
in 7.7.1908/testing
:
QA
Sender SMTP refusal message: 554 5.7.1 Rejected suspicious office document macro
Destination system maillog:
Oct 30 11:32:20 mail rspamd[14718]: <c01275>; lua; common.lua:102: oletools: result - office macrofound: "AutoExec + Suspicious (autoopen,Open,system,ShowWindow,CreateObject) - score: 1"
Oct 30 11:32:20 mail rspamd[14718]: <c01275>; proxy; rspamd_add_passthrough_result: <20191002151742.309027F05E@mhssub101.bizmail.nifty.com>: set pre-result to 'reject' (no score): 'Rejected suspicious office document macro' from oletools(1)
rspamd symbol: OLETOOLS
in 7.7.1908/testing
:
in 7.7.1908/testing
:
in 7.7.1908/testing
:
in 7.7.1908/testing
:
in 7.7.1908/updates
:
Using oletools (http://www.decalage.info/python/oletools) we could scan MS Office files looking for suspicious macros and block malicious emails.
We need: