Email Filter *.Doc Type File Attachment

jon2371

• September 15, 2020 00:46

Hi to All, Good Day! I have create a Email Filter to Filter all Incoming Email Attachement with File Type of "*.doc". I tried to do this on email filter and filter the body with the contains of Content-Disposition:attachment;filename=".doc", but it is not working....Please help on how to do it.. Thanks, Jo

• 

  keat63

  • September 15, 2020 17:39

  I'm not sure the filename part would work. Basically, your'e telling the filter to expect a filename called ".doc". But in fact the filename will be something.doc, or anything.doc, or something-else.doc I found this on another web site which might work. There isn't a "has attachment" filter option directly, but there is info in the headers that will get the job done. So you can use: Body - Contains Content-Disposition: attachment; That would catch every email with any type of attachment. But be warned, that includes signature images and a host of other benign files. The better option is to filter out specific types of attachments. For example: Body - Contains Content-Type: application/vnd.ms-word.document.macroEnabled OR Body - Contains Content-Disposition: attachment; AND Body - Contains .docm Would catch the macro enabled word doc files that are so popular with the cryptowall variants. Body - Contains Content-Type: application/zip; OR Body - Contains Content-Disposition: attachment; AND Body - Contains .zip Would catch anything with a .zip file attachment.

  0
• 

  Handssler Lopez

  • September 15, 2020 17:43

  Filter for .doc or .docx files or document cPanel >> Global Email Filters >> add new *** Attached image Edit: my error in the image all the fields are "body" not from

  0
• 

  cPanelLauren

  • September 15, 2020 21:39

  Thanks both @keat63 and @Handssler Lopez

  0
• 

  jon2371

  • September 16, 2020 05:07

  I'm not sure the filename part would work. Basically, your'e telling the filter to expect a filename called ".doc". But in fact the filename will be something.doc, or anything.doc, or something-else.doc I found this on another web site which might work. There isn't a "has attachment" filter option directly, but there is info in the headers that will get the job done. So you can use: Body - Contains Content-Disposition: attachment; That would catch every email with any type of attachment. But be warned, that includes signature images and a host of other benign files. The better option is to filter out specific types of attachments. For example: Body - Contains Content-Type: application/vnd.ms-word.document.macroEnabled OR Body - Contains Content-Disposition: attachment; AND Body - Contains .docm Would catch the macro enabled word doc files that are so popular with the cryptowall variants. Body - Contains Content-Type: application/zip; OR Body - Contains Content-Disposition: attachment; AND Body - Contains .zip Would catch anything with a .zip file attachment.

  
  Thank you, it solved my problem.

  0

Please sign in to leave a comment.