Filter on attachment name with Procmail

After a recent spike in emails with .zip and .doc attachments… a quick way to filter them with procmail:


# Drop mails with lame attachments
:0 B
* .*filename=.*\.(zip|rar|rtf|doc|docm|xls|com|hlp|vbs|wsf|eml|shs|exe|nws|chm|pif|vbe|hta|scr|reg|bat)\"?\;?$
1in/spam/

Stick this in your .procmailrc

Updated: 7 April 2016, I’ll keep adding to this as I find things to block.