Password protected archives (e.g. zip-files) can get detected by clamAV as Heuristic - you can enable this in the virus-detector settings.
This then causes the spam-detector to add the heuristic score as points to the spam result, which you can use in the rule-system
see: https://pmg.proxmox.com/pmg-docs/pmg-admin-guide.html#pmgconfig_clamav
I would set the heuristic score to a rather high number and then either quarantine or block mails which reach that number