Sorry, I have to push this one up (again). Mailcow is running up-to-date with Version 2024-04.
I did a self-test by sending me an email with an ms office document (*.docm) including a macro attached.
The sender is a sogo-contact. As IMVHO a sysadmin is not able to control contacts from all users, therefore I changed in rspamd –> rspamd –> Symbols –> SOGO_CONTACT –> Score ‘0.000’.
Checking this specific email in the rspamd-gui brings up:
SOGO_CONTACT (-99)
OLEFY_MACRO (20)
And from the cli while checking the logs:
olefy-mailcow-1 | olefy INFO eof_received <ef5664> 18679 bytes (stream size)
olefy-mailcow-1 | olefy INFO oletools <ef5664> application/x-decompression-error-gzip- (libmagic output)
olefy-mailcow-1 | olefy INFO eof_received <ef5664> (‘172.22.1.5’, 45028) response send: b’[ { “script_name”: “olevba”, “version”: “0.60.2dev1”, “python_version”: [ 3, 11, 6 ], “url”: “http://decalage.info/python/oletools”, “type”: “MetaInformation” }, { “container”: null, “file”: “/tmp/1712402330.4334922.45028.ef5664”, “json_conversion_successful”: true, “analysis”: [], “code_deobfuscated”: null, “do_deobfuscate”: false, “show_pcode”: false, “type”: “OpenXML”, “macros”: [ { “vba_filename”: “ThisDocument.cls”, “subfilename”: “word/vbaProject.bin”, “ole_stream”: “VBA/ThisDocument”, “code”: null } ] }]\t\n\n\t’
rspamd-mailcow-1 | 2024-04-06 13:18:51 #76(normal) <ef5664>; task; rspamd_task_write_log: id: bb690c183e994a9a93dbf64cc3543b51@zxy.de, qid: <32DAC141513>, ip: 145.253.228.164, from: xx.yy@zxy.de, (default: F (no action): [-81.52/9.00] [SOGO_CONTACT(-99.00){},OLEFY_MACRO(20.00){},DWL_DNSWL_LOW(-1.00){zxy.de:dkim;},DMARC_POLICY_ALLOW(-0.50){zxy.de;none;},IP_REPUTATION_HAM(-0.41){asn: 3209(-0.40), country: DE(-0.01), ip: 145.253.228.164(0.00);},R_DKIM_ALLOW(-0.20){zxy.de:s=vfde-mb-mr2-23sep;},R_SPF_ALLOW(-0.20){+ip4:145.253.228.160/29:c;},MIME_GOOD(-0.10){multipart/mixed;text/plain;},RCVD_IN_DNSWL_LOW(-0.10){145.253.228.164:from;},MX_GOOD(-0.01){},BAYES_HAM(-0.00){40.73%;},ARC_NA(0.00){},ARC_SIGNED(0.00){efg.de:s=dkim:i=1;},ASN(0.00){asn:3209, ipnet:145.253.0.0/16, country😃E;},BCC(0.00){},DKIM_TRACE(0.00){zxy.de:+;},FROM_EQ_ENVFROM(0.00){},FROM_NO_DN(0.00){},HAS_ATTACHMENT(0.00){},HAS_X_PRIO_THREE(0.00){3;},MID_RHS_MATCH_FROM(0.00){},MIME_TRACE(0.00){0:+;1:+;2:~;},MISSING_XM_UA(0.00){},OLETOOLS(0.00){—–M–;},PREVIOUSLY_DELIVERED(0.00){aa.bb@efg.de;},RCPT_COUNT_ONE(0.00){1;},RCPT_MAILCOW_DOMAIN(0.00){efg.de;},RCVD_COUNT_THREE(0.00){3;},RCVD_TLS_LAST(0.00){},TO_DN_NONE(0.00){},TO_MATCH_ENVRCPT_ALL(0.00){}]), len: 27703, time: 4695.957ms, dns req: 38, digest: <3b32c09c13a85617ae08f01bf74a96f1>, rcpts: aa.bb@efg.de, mime_rcpts: aa.bb@efg.de
rspamd-mailcow-1 | 2024-04-06 13:18:51 #76(normal) <ef5664>; task; rspamd_protocol_http_reply: regexp statistics: 0 pcre regexps scanned, 2 regexps matched, 3463 regexps total, 3193 regexps cached, 0B scanned using pcre, 2.04KiB scanned total
Obviously the macro is detected and scored with “20”. That’s perfectly o.k. Not o.k. is the the “-99” score to the sender treated as a so-called trusted sogo contact while I changed this scoring to “0”.
Perfect would be to detach the attachment (any attachment with macros) from the email with a hint for the receiver. How can this be configured?
What’s wrong in here?
Anyone?