Blocking .docm files

[lzolotonos]

Hi,

we see a lot of files with extension docm attacking the mailserver via smtp and identified as malicious by wildfire. is there a way to simply block those files via File Blocking profile like we are doing for pe and other file types. The point is that there is no possibility to choose such file type in File Blocking profile. 

Any other idea?

Thanks.

Leonid

[scottsander]

Configure your spam filter to block attachments that have the .docm extension.

[reaper]

not sure if .docm are 'special' in any way, but have you tried regular doc and docx ? file types are identified by more than just their extention and if the docm files match regular 'microsoft office word' formatting, either .doc or .docx should match

[BPry · Accepted solution]

Reaper,

There really isn't anything special with docm except for the fact that it by default is macro enabled. If you block msoffice you should effectively block docm files as well. 

OP,

I'm going to guess that you are looking at specifically docm files, which I do not believe is a registered file type with PA. It may be worth creating a custom signature and blocking them like that, however you could just as easily have your System Admin enable a group policy that disables your end-users access to Macros in Word and Excel. That way even if you can't get the docm file extension blocked your users would at least not be able to open them.