Attachment Filtering not working - ORF Forums

Fighting against LOCKY we made some "Attachment Filtering" rules:

Filter by MIME Content type:
- application/msword // Simple Text // Replace attchment with removal..."
- multipart/mixed // Simple Text // Replace attchment with removal..."

If i take a look into a Mail with a direct Word-Attachment i see "multipart/mixed" as content type -- but Mail still passed (WITH FULL attachment inside)

Sender is on NO Whitelist

Any ideas / help?
Thank you
Uwe

Hello Daniel,
thanks for your response - a good AV scanner is not our Problem as we are using ESET NOD32.
THIS Variants of LOCKY are recognized - but will the next variant recognized in time? (same for ClamAV)

So our solution should be to block all native attached incoming Office-Documents.

partial Message Header:
From: Uwe Kortkamp <my private adress>
To: "Kortkamp, Uwe" <my office adress>
Content-Type: multipart/mixed; boundary="001a114a6b7c13d3ad052ca871f7"
Return-Path: <my private adress>
X-OriginalArrivalTime: 26 Feb 2016 11:38:13.0317 (UTC) FILETIME=[2CFF1F50:01D1708A]

ORF Attachment filter settings posted in first message.

Temporary solution is to block Attachments with known Extensions (.doc|docx and so on)

Thanks again
Uwe

EDIT:
the idea to block documents with Macros only is not bad.... ESET cant this.

But Attachment filtering via MIME Type should work also!?

Hello Daniel,
thanks for your response - your has been 1 hour too early.

I found the solution by myself:
Don't know why... but only Outlook shows this attachment as 'multipart/mixed' (maybe Exchange changed something).

For testing i made a "Attachment blocking rule" "MIME TYPE */*" and ORF wrote in his log for those attachments "application/vnd.openxmlformats-officedocument. (word/excel and so on)"

With a rule "MIME TYPE application/vnd.openxmlformats-officedocument.*" it catches all those (un-) wanted Attachments.

Thanks again - so call can be closed

Question for you Uwe: are you blocking all MS-Office document attachments or is there a certain pattern that helps protect against Locky?

I looked up the MIME attachment types and perhaps I am not understanding the thread but it looks like your rule will block all common Office formats docx, pptx, xlsx.

Source:
http://stackoverflow.com/questions/4212861/what-is-a-correct-mime-type-for-docx-pptx-etc

Thanks

@Sam Russo: Hello Sam,
yes, i am blocking ALL Office Document - but not only with this one rule.
Nobody knows about future "LOCKY's" or maybe "faked MIME Types" (dont know if its possible).

If somebody wants to send me a Office Document, he can ZIP it - so its not so easy possible to open it accidentally or maybe catch a virus through Outlook Preview Pane

I have 1 blocking rule like explained, / 3 for "application/msword" (msexcel/mspowerpoint) and 4 rules where extensions are blocked via RegExp ".*\.(doc|dot|docx|docm|dotx|dotm|docb)$" (and same for Excel/Access and Powerpoint)

Hope it helps

@uwe.kortkamp: Thanks for the clarification.

If you are running Windows then AppLocker (application whitelisting) is a good method of blocking these attacks.

Good luck,
Sam

@Daniel Novak (Vamsoft): Thank you very much for your post Daniel - I implemented ClamAV with the "OLE2BlockMacros" option and it's working great! I went into the "Whitelist Test Exceptions" screen within ORF and enabled the "External Agents Test" so that ClamAV runs on whitelisted email also. Thanks again for the very helpful and informative post!