topic Re: Blocking .docm files in General Topics

Blocking .docm files

lzolotonos — Fri, 29 Jul 2016 11:26:12 GMT

Hi,

we see a lot of files with extension docm attacking the mailserver via smtp and identified as malicious by wildfire. is there a way to simply block those files via File Blocking profile like we are doing for pe and other file types. The point is that there is no possibility to choose such file type in File Blocking profile.

Any other idea?

Thanks.

Leonid

Re: Blocking .docm files

scottsander — Wed, 03 Aug 2016 13:39:03 GMT

Configure your spam filter to block attachments that have the .docm extension.

Re: Blocking .docm files

reaper — Wed, 03 Aug 2016 13:43:08 GMT

not sure if .docm are 'special' in any way, but have you tried regular doc and docx ? file types are identified by more than just their extention and if the docm files match regular 'microsoft office word' formatting, either .doc or .docx should match

Re: Blocking .docm files

BPry — Wed, 03 Aug 2016 14:57:47 GMT

Reaper,

There really isn't anything special with docm except for the fact that it by default is macro enabled. If you block msoffice you should effectively block docm files as well.

OP,

I'm going to guess that you are looking at specifically docm files, which I do not believe is a registered file type with PA. It may be worth creating a custom signature and blocking them like that, however you could just as easily have your System Admin enable a group policy that disables your end-users access to Macros in Word and Excel. That way even if you can't get the docm file extension blocked your users would at least not be able to open them.