Mailing List Archive: [clamav-users] need to make a signature that matches word documents with a specific piece of metadata

Hi there,

On Sun, 26 Jan 2020, Jon 'Boli' Copeland wrote:

> could anyone help me make a signature that matches all docx word documents
> with the metadata item "Last Saved By" matching a specific string - you could
> use "ABCDEF" as an example.

See for example

https://www.clamav.net/documents/creating-signatures-for-clamav
http://www.clamav.net/documents/body-based-signature-content-format

> i guess i need to somehow treat them as archives/zip and unpack/scan within

See for example the clamd.conf 'man' page.

--

73,
Ged.

_______________________________________________

clamav-users mailing list
clamav-users@lists.clamav.net
https://lists.clamav.net/mailman/listinfo/clamav-users

Help us build a comprehensive ClamAV guide:
https://github.com/vrtadmin/clamav-faq

http://www.clamav.net/contact.html#ml