detect one-note attachment abuse (malware)

[kiran.landge]

Hi,

We are witness of one-Note attachment with .one file extension which execute payload using cmd & Power-shell when user tryied to open it from MS Outlook mail client.

Can we detect & Block abuse contain inside of any one-note / document at Email Gateway ?

We have remove attachment rule for set of known executable file extensions as mentioned in attach snaps.

Please share configuration steps if anyone have enforce such rules with object to look inside file abuse code.

Regards,

Kiran Landge

 

[Stoiko Ivanov]

Just add 'one' as further extension in the match filename object containing '.*\.(vbs|pif|...`

I hope this helps!