API tools faq
paste
Advertisement
Guest User

filename.rules.conf

a guest
Nov 26th, 2023
48
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
Bash 8.08 KB | None | 0 0
raw download clone embed print report
  1. #
  2. # NOTE: Fields are separated by TAB characters --- Important!
  3. #
  4. # Syntax is allow/deny/deny+delete/rename/rename to replacement-text/email-addresses,
  5. #           then regular expression,
  6. #           then log text,
  7. #           then user report text.
  8. #
  9. # The "email-addresses" can be a space or comma-separated list of email
  10. # addresses. If the rule hits, the message will be sent to these address(es)
  11. # instead of the original recipients.
  12.  
  13. # If a rule is a "rename" rule, then the attachment filename will be renamed
  14. # according to the "Default Rename Pattern" setting in MailScanner.conf.
  15. # If a rule is a "rename" rule and the "to replacement-text" is supplied, then
  16. # the text matched by the regular expression in the 2nd field of the line
  17. # will be replaced with the "replacement-text" string.
  18. # For example, the rule
  19. # rename to .ppt    \.pps$  Renamed .pps to .ppt    Renamed .pps to .ppt
  20. # will find all filenames ending in ".pps" and rename them so they end in
  21. # ".ppt" instead.
  22.  
  23. # Due to a bug in Outlook Express, you can make the 2nd from last extension
  24. # be what is used to run the file. So very long filenames must be denied,
  25. # regardless of the final extension.
  26. #deny   .{150,}         Very long filename, possible OE attack                      Very long filenames are good signs of attacks against Microsoft e-mail packages
  27.  
  28. # JKF 10/08/2007 Adobe Acrobat nastiness
  29. rename  \.fdf$          Dangerous Adobe Acrobat data-file                       Opening this file can cause auto-loading of any file from the internet
  30.  
  31. # JKF 04/01/2005 More Microsoft security vulnerabilities
  32. deny    \.ico$          Windows icon file security vulnerability                    Possible buffer overflow in Windows
  33. deny    \.ani$          Windows animated cursor file security vulnerability             Possible buffer overflow in Windows
  34. deny    \.cur$          Windows cursor file security vulnerability                  Possible buffer overflow in Windows
  35. #deny   \.hlp$          Windows help file security vulnerability                    Possible buffer overflow in Windows
  36.  
  37. # These 4 are well known viruses.
  38. deny    pretty\s+park\.exe$ "Pretty Park" virus                             "Pretty Park" virus
  39. deny    happy99\.exe$       "Happy" virus                                   "Happy" virus
  40. deny    \.ceo$      WinEvar virus attachment                            Often used by the WinEvar virus
  41. deny    webpage\.rar$   I-Worm.Yanker virus attachment                          Often used by the I-Worm.Yanker virus
  42.  
  43. # JKF 08/07/2005 Several virus scanners may miss this one
  44. deny    \.cab$          Possible malicious Microsoft cabinet file                   Cabinet files may hide viruses
  45.  
  46. # These are in the archives which are Microsoft Office 2007 files (e.g. docx)
  47. allow   \.shp\.xml$     -   -
  48. allow   \.xml\d*\.rel$      -   -
  49. allow   \.x\d+\.rel$        -   -
  50. allow   \.rtf$          -   -
  51. allow   \.dbf$          -   -
  52.  
  53. # These are known to be mostly harmless.
  54. allow   \.jpg$          -   -
  55. allow   \.gif$          -   -
  56. # .url is arguably dangerous, but I can't just ban it...
  57. allow   \.url$          -   -
  58. allow   \.vcf$          -   -
  59. allow   \.txt$          -   -
  60. allow   \.zip$          -   -
  61. allow   \.t?gz$         -   -
  62. allow   \.bz2$          -   -
  63. allow   \.Z$            -   -
  64. allow   \.rpm$          -   -
  65. # PGP and GPG
  66. allow   \.gpg$          -   -
  67. allow   \.pgp$          -   -
  68. allow   \.sig$          -   -
  69. allow   \.asc$          -   -
  70. # Macintosh archives
  71. allow   \.hqx$          -   -
  72. allow   \.sit.bin$      -   -
  73. allow   \.sea$          -   -
  74. # Backup files
  75. allow   \.bak$          -   -
  76. # And TeX and LaTeX are harmless AFAIK
  77. allow   \.tex$          -   -
  78.  
  79. # These are known to be dangerous in almost all cases.
  80. deny    \.reg$      Possible Windows registry attack                        Windows registry entries are very dangerous in email
  81. deny    \.chm$      Possible compiled Help file-based virus                     Compiled help files are very dangerous in email
  82. # See http://office.microsoft.com/2000/articles/Out2ksecFAQ.htm for more info.
  83. deny    \.cnf$      Possible SpeedDial attack                           SpeedDials are very dangerous in email
  84. deny    \.hta$      Possible Microsoft HTML archive attack                      HTML archives are very dangerous in email
  85. deny    \.ins$      Possible Microsoft Internet Comm. Settings attack               Windows Internet Settings are dangerous in email
  86. deny    \.jse?$     Possible Microsoft JScript attack                       JScript Scripts are dangerous in email
  87. deny    \.job$      Possible Microsoft Task Scheduler attack                    Task Scheduler requests are dangerous in email
  88. deny    \.lnk$      Possible Eudora *.lnk security hole attack                  Eudora *.lnk security hole attack
  89. # Removed ".mat" from next line as widely used by Matlab
  90. deny    \.ma[dfgmqrsvw]$    Possible Microsoft Access Shortcut attack               Microsoft Access Shortcuts are dangerous in email
  91. deny    \.pif$      Possible MS-Dos program shortcut attack                     Shortcuts to MS-Dos programs are very dangerous in email
  92. deny    \.scf$      Possible Windows Explorer Command attack                    Windows Explorer Commands are dangerous in email
  93. deny    \.sct$      Possible Microsoft Windows Script Component attack              Windows Script Components are dangerous in email
  94. deny    \.shb$      Possible document shortcut attack                       Shortcuts Into Documents are very dangerous in email
  95. deny    \.shs$      Possible Shell Scrap Object attack                      Shell Scrap Objects are very dangerous in email
  96. deny    \.vb[es]$   Possible Microsoft Visual Basic script attack                   Visual Basic Scripts are dangerous in email
  97. deny    \.ws[cfh]$  Possible Microsoft Windows Script Host attack                   Windows Script Host files are dangerous in email
  98. deny    \.xnk$      Possible Microsoft Exchange Shortcut attack                 Microsoft Exchange Shortcuts are dangerous in email
  99.  
  100. # These are new dangerous attachment types according to Microsoft in
  101. # http://support.microsoft.com/?kbid=883260
  102. #deny   \.cer$      Dangerous Security Certificate (according to Microsoft)             Dangerous attachment according to Microsoft Q883260
  103. deny    \.its$      Dangerous Internet Document Set (according to Microsoft)            Dangerous attachment according to Microsoft Q883260
  104. deny    \.mau$      Dangerous attachment type (according to Microsoft)              Dangerous attachment according to Microsoft Q883260
  105. deny    \.md[az]$   Dangerous attachment type (according to Microsoft)              Dangerous attachment according to Microsoft Q883260
  106. deny    \.prf$      Dangerous Outlook Profile Settings (according to Microsoft)         Dangerous attachment according to Microsoft Q883260
  107. deny    \.pst$      Dangerous Office Data File (according to Microsoft)             Dangerous attachment according to Microsoft Q883260
  108. #deny   \.tmp$      Dangerous Temporary File (according to Microsoft)               Dangerous attachment according to Microsoft Q883260
  109. deny    \.vsmacros$ Dangerous Visual Studio Macros (according to Microsoft)             Dangerous attachment according to Microsoft Q883260
  110. deny    \.vs[stw]$  Dangerous attachment type (according to Microsoft)              Dangerous attachment according to Microsoft Q883260
  111. deny    \.ws$       Dangerous Windows Script (according to Microsoft)               Dangerous attachment according to Microsoft Q883260
  112.  
  113.  
  114. # These 2 added by popular demand - Very often used by viruses
  115. deny    \.com$      Windows/DOS Executable                              Executable DOS/Windows programs are dangerous in email
  116. deny    \.exe$      Windows/DOS Executable                              Executable DOS/Windows programs are dangerous in email
  117.  
  118. # These are very dangerous and have been used to hide viruses
  119. deny    \.scr$      Possible virus hidden in a screensaver                      Windows Screensavers are often used to hide viruses
  120. deny    \.bat$      Possible malicious batch file script                        Batch files are often malicious
  121. deny    \.cmd$      Possible malicious batch file script                        Batch files are often malicious
  122. deny    \.cpl$      Possible malicious control panel item                       Control panel items are often used to hide viruses
  123. deny    \.mhtml$    Possible Eudora meta-refresh attack                     MHTML files can be used in an attack against Eudora
  124.  
  125. # Deny filenames containing CLSID's
  126. #deny   \{[a-hA-H0-9-]{25,}\}   Filename trying to hide its real type               Files containing  CLSID's are trying to hide their real type
  127.  
  128. # Deny filenames with lots of contiguous white space in them.
  129. #deny   \s{10,}     Filename contains lots of white space                       A long gap in a name is often used to hide part of it
  130.  
  131. # Allow repeated file extension, e.g. blah.zip.zip
  132. allow   (\.[a-z0-9]{3})\1$  -   -
  133.  
  134. # Allow days of the week and months in doc names, e.g. blah.wed.doc
  135. allow   \.(mon|tue|wed|thu|fri|sat|sun)\.[a-z0-9]{3}$   -   -
  136. allow   \.(jan|feb|mar|apr|may|jun|june|jul|july|aug|sep|sept|oct|nov|dec)\.[a-z0-9]{3}$    -   -
  137.  
  138. # Deny all other double file extensions. This catches any hidden filenames.
  139. #deny   \.[a-z][a-z0-9]{2,3}\s*\.[a-z0-9]{3,4}$ Found possible filename hiding              Attempt to hide real filename extension
  140.  
  141.  
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!