On 7/5/19 11:59 AM, Hasan Ç. wrote: > > Rejecting all of them with postfix is not a option for me. > > I tried some spamassasian rules to give them high score but not worked > as expected. > > I would appreciate it if you share your experiences. >
The next version of SpamAssassin will have a plugin that can detect and score these: https://svn.apache.org/repos/asf/spamassassin/trunk/lib/Mail/SpamAssassin/Plugin/OLEMacro.pm In the meantime, your best bet might be to turn on AlertOLE2Macros yes in your clamd.conf. That will block any office documents that look like they contain VBA macros.
