Macro Enabled Attachments

Spambrella have implemented logic into our engines to help deal with the recent Dridex campaigns in which emails contain macro enabled attachments. As such there may be emails with legitimate macro enabled attachments being detected as spam and subsequently quarantined. If this occurs it is recommended that the end user recipient release these from quarantine. For silent users the org admin or channel admin can release these emails on their behalf.

In order to resolve this situation, if you are sending outbound macro attachments we recommend that you create an outbound filter to allow sending of these emails.

To whitelist outbound emails so that attachments are not blocked:

  • Click on Company Settings
  • Click on Filters tab
  • Click on New Filter button
  • Choose a name for the filter (i.e. Whitelisted outbound attachments)
  • Click on the Continue button
  • Choose the proper scope for the filter
  • If you want the filter to be applied to everyone, leave scope = “Company”.
  • If you want to target a specific individual or group of individuals, change the scope.
  • Choose Attachment Type from the drop-down list of options message elements
  • Choose IS and specify Other *Office Files
  • Choose “Allow” from the drop-down list of actions.
  • Click Save.

This filter will allow you to send outbound attachments that contain macro elements.