Email Filter *.Doc Type File Attachment

jon2371

Registered
Sep 1, 2020
2
0
1
Philippines
cPanel Access Level
Website Owner
Hi to All,

Good Day!

I have create a Email Filter to Filter all Incoming Email Attachement with File Type of "*.doc".
I tried to do this on email filter and filter the body with the contains of Content-Disposition:attachment;filename=".doc",
but it is not working....Please help on how to do it..

Thanks,
Jo
 

keat63

Well-Known Member
Nov 20, 2014
1,763
199
93
cPanel Access Level
Root Administrator
I'm not sure the filename part would work.
Basically, your'e telling the filter to expect a filename called ".doc".
But in fact the filename will be something.doc, or anything.doc, or something-else.doc

I found this on another web site which might work.






There isn't a "has attachment" filter option directly, but there is info in the headers that will get the job done. So you can use:

Body - Contains
Content-Disposition: attachment;

That would catch every email with any type of attachment. But be warned, that includes signature images and a host of other benign files. The better option is to filter out specific types of attachments. For example:

Body - Contains
Content-Type: application/vnd.ms-word.document.macroEnabled
OR
Body - Contains
Content-Disposition: attachment;
AND
Body - Contains
.docm

Would catch the macro enabled word doc files that are so popular with the cryptowall variants.

Body - Contains
Content-Type: application/zip;
OR
Body - Contains
Content-Disposition: attachment;
AND
Body - Contains
.zip

Would catch anything with a .zip file attachment.
 
Last edited:
  • Like
Reactions: jon2371

jon2371

Registered
Sep 1, 2020
2
0
1
Philippines
cPanel Access Level
Website Owner
I'm not sure the filename part would work.
Basically, your'e telling the filter to expect a filename called ".doc".
But in fact the filename will be something.doc, or anything.doc, or something-else.doc

I found this on another web site which might work.






There isn't a "has attachment" filter option directly, but there is info in the headers that will get the job done. So you can use:

Body - Contains
Content-Disposition: attachment;

That would catch every email with any type of attachment. But be warned, that includes signature images and a host of other benign files. The better option is to filter out specific types of attachments. For example:

Body - Contains
Content-Type: application/vnd.ms-word.document.macroEnabled
OR
Body - Contains
Content-Disposition: attachment;
AND
Body - Contains
.docm

Would catch the macro enabled word doc files that are so popular with the cryptowall variants.

Body - Contains
Content-Type: application/zip;
OR
Body - Contains
Content-Disposition: attachment;
AND
Body - Contains
.zip

Would catch anything with a .zip file attachment.
Thank you, it solved my problem.