After a recent spike in emails with .zip and .doc attachments… a quick way to filter them with procmail:
# Drop mails with lame attachments :0 B * .*filename=.*\.(zip|rar|rtf|doc|docm|xls|com|hlp|vbs|wsf|eml|shs|exe|nws|chm|pif|vbe|hta|scr|reg|bat)\"?\;?$ 1in/spam/
Stick this in your .procmailrc
Updated: 7 April 2016, I’ll keep adding to this as I find things to block.