<html><head><meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">Ich habe es mal mit einer Multimap inklusive Force Action versucht.<div class=""><br class=""></div><div class="">Wenn ich type = „content“ und filter = „body“ nehme, sollte der RAW-Content nach den bekannten Strings durchsucht werden, oder?</div><div class=""><br class=""></div><div class="">Also ohne in <span style="caret-color: rgb(0, 150, 153); color: rgb(0, 150, 153); font-family: Monaco, Consolas, "Andale Mono", "DejaVu Sans Mono", monospace; font-size: 15px; background-color: rgb(247, 252, 252);" class="">EA\r\nAABI</span> die \ als Steuerzeichen zu interpretieren, richtig?</div><div class=""><br class=""></div><div class=""><br class=""></div><div class=""><br class=""></div><div class="">Viele Grüße! Frank</div><div class=""><br class=""></div><div class=""><div><br class=""><blockquote type="cite" class=""><div class="">Am 24.04.2020 um 16:20 schrieb Frank Fiene <<a href="mailto:ffiene@veka.com" class="">ffiene@veka.com</a>>:</div><br class="Apple-interchange-newline"><div class=""><meta http-equiv="Content-Type" content="text/html; charset=utf-8" class=""><div style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">Ja, aber sind das nur Beispiele?<div class=""><br class=""></div><div class="">Und ist das AND Teil des Strings "<span style="caret-color: rgb(0, 150, 153); color: rgb(0, 150, 153); font-family: Monaco, Consolas, "Andale Mono", "DejaVu Sans Mono", monospace; font-size: 15px; background-color: rgb(247, 252, 252);" class="">AAAAATEy AND EA\r\nAABI</span>“ oder ein UND?</div><div class=""><br class=""></div><div class="">Das macht man am besten in rspamd, oder doch in body-checks in Postfix?</div><div class=""><br class=""></div><div class=""><br class=""></div><div class=""><br class=""></div><div class=""><br class=""><div class=""><blockquote type="cite" class=""><div class="">Am 24.04.2020 um 16:08 schrieb Ralf Hildebrandt <<a href="mailto:Ralf.Hildebrandt@charite.de" class="">Ralf.Hildebrandt@charite.de</a>>:</div><br class="Apple-interchange-newline"><div class=""><div class="">* Frank Fiene <<a href="mailto:ffiene@veka.com" class="">ffiene@veka.com</a>>:<br class=""><blockquote type="cite" class="">Hat schon jemand eine einfache Möglichkeit gefunden, um diese gefährlichen Mails gar nicht erst auf die Mailserver kommen zu lassen?<br class=""><br class="">Z.B. einfach RTF blockieren?<br class=""><br class=""><a href="https://blog.zecops.com/vulnerabilities/youve-got-0-click-mail/" class="">https://blog.zecops.com/vulnerabilities/youve-got-0-click-mail/</a><br class=""></blockquote><br class="">Na, da stehen doch die Strings drin!<br class="">"Indicators of Compromise"<br class=""><br class="">-- <br class="">Ralf Hildebrandt<br class=""> Geschäftsbereich IT | Abteilung Netzwerk<br class=""> Charité - Universitätsmedizin Berlin<br class=""> Campus Benjamin Franklin<br class=""> Hindenburgdamm 30 | D-12203 Berlin<br class=""> Tel. +49 30 450 570 155 | Fax: +49 30 450 570 962<br class=""> <a href="mailto:ralf.hildebrandt@charite.de" class="">ralf.hildebrandt@charite.de</a> | <a href="https://www.charite.de/" class="">https://www.charite.de</a><br class=""><span class="Apple-tab-span" style="white-space:pre"> </span> </div></div></blockquote></div><br class=""><div class="">
<div dir="auto" style="caret-color: rgb(0, 0, 0); letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div dir="auto" style="caret-color: rgb(0, 0, 0); letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div class="">Viele Grüße!<br class="">i.A. Frank Fiene<br class="">-- <br class="">Frank Fiene<br class="">IT-Security Manager VEKA Group<br class=""><br class="">Fon: +49 2526 29-6200<br class="">Fax: +49 2526 29-16-6200<br class="">mailto: <a href="mailto:ffiene@veka.com" class="">ffiene@veka.com</a><br class=""><a href="http://www.veka.com/" class="">http://www.veka.com</a><br class=""><br class="">PGP-ID: 62112A51<br class="">PGP-Fingerprint: 7E12 D61B 40F0 212D 5A55 765D 2A3B B29B 6211 2A51<br class="">Threema: VZK5NDWW<br class=""><br class="">VEKA AKTIENGESELLSCHAFT <br class="">Dieselstr. 8 <br class="">48324 Sendenhorst <br class="">Deutschland/Germany <br class=""><a href="http://www.veka.com" class="">http://www.veka.com</a> <br class=""><br class="">Vorstand/Executive Board: Andreas Hartleif (Vorsitzender/CEO), <br class="">Pascal Heitmar, Josef L. Beckhoff, Elke Hartleif, Dr. Werner Schuler, <br class="">Vorsitzender des Aufsichtsrates/Chairman of Supervisory Board: Dr. Andreas W. Hillebrand <br class=""><br class="">HRB 8282 AG Münster/District Court of Münster</div></div></div>
</div>
<br class=""></div></div></div></blockquote></div><br class=""><div class="">
<div dir="auto" style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div dir="auto" style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0); letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><div>Viele Grüße!<br class="">i.A. Frank Fiene<br class="">-- <br class="">Frank Fiene<br class="">IT-Security Manager VEKA Group<br class=""><br class="">Fon: +49 2526 29-6200<br class="">Fax: +49 2526 29-16-6200<br class="">mailto: <a href="mailto:ffiene@veka.com" class="">ffiene@veka.com</a><br class=""><a href="http://www.veka.com" class="">http://www.veka.com</a><br class=""><br class="">PGP-ID: 62112A51<br class="">PGP-Fingerprint: 7E12 D61B 40F0 212D 5A55 765D 2A3B B29B 6211 2A51<br class="">Threema: VZK5NDWW<br class=""><br class="">VEKA AKTIENGESELLSCHAFT <br class="">Dieselstr. 8 <br class="">48324 Sendenhorst <br class="">Deutschland/Germany <br class="">http://www.veka.com <br class=""><br class="">Vorstand/Executive Board: Andreas Hartleif (Vorsitzender/CEO), <br class="">Pascal Heitmar, Josef L. Beckhoff, Elke Hartleif, Dr. Werner Schuler, <br class="">Vorsitzender des Aufsichtsrates/Chairman of Supervisory Board: Dr. Andreas W. Hillebrand <br class=""><br class="">HRB 8282 AG Münster/District Court of Münster</div></div></div>
</div>
<br class=""></div></body></html>