Scan excel with macro

[abzsol]

Good morning,

in these days I've seen that lots of messages with an excel with macro (.xlsm files).
Obviously the files has a virus in it, how can I make it being scanned (or blocked) by PMG?
Thanks in advance.

 

[dcsapak]

you could add a rule that matches on the content-type or the filename and block it

 

[abzsol]

I have make this rule
filename=.*\.(vbs|pif|lnk|shs|shb|xlsm)

 

[treloskilo]

filename=.*\.(ace|adp|app|asp|ba[st]|cer|chm|cmd|cnt|com|cpl|crt|csh|der|dll|exe|fxp|gadget|hlp|hpj|hta|in[fs]|img|isp|its|jse?|ksh|lnk|ma[dfgmqrstuvw]|md[detwz]|msc|msh|mshxml|msh[12]|msh[12]xml|ms[ipt]|ops|osd|pcd|pif|plg|prf|prg|pst|reg|sc[frt]|sh[bs]|ps[12]|ps[12]xml|psc[12|]tmp|url|vb[eps]?|vsmacros|vsw|ws[cfh]?|xnk|ade|cla|class|sh|grp|jar|mcf|ocx|pl|xbap)

 

[abzsol]

filename=.*\.(ace|adp|app|asp|ba[st]|cer|chm|cmd|cnt|com|cpl|crt|csh|der|dll|exe|fxp|gadget|hlp|hpj|hta|in[fs]|img|isp|its|jse?|ksh|lnk|ma[dfgmqrstuvw]|md[detwz]|msc|msh|mshxml|msh[12]|msh[12]xml|ms[ipt]|ops|osd|pcd|pif|plg|prf|prg|pst|reg|sc[frt]|sh[bs]|ps[12]|ps[12]xml|psc[12|]tmp|url|vb[eps]?|vsmacros|vsw|ws[cfh]?|xnk|ade|cla|class|sh|grp|jar|mcf|ocx|pl|xbap)

There are lots of files / extensions
Do you suggest all of them?
@dcsapak what do you think?

 

[tom]

There are lots of files / extensions
Do you suggest all of them?
@dcsapak what do you think?

We suggested to use "Content Type Filter", not matching filenames/extensions.

For example, check the default "What Object: Office Files, Dangerous Content, Images or Multimedia"

 

[abzsol]

We suggested to use "Content Type Filter", not matching filenames/extensions.

For example, check the default "What Object: Office Files, Dangerous Content, Images or Multimedia"

Thanks