We recently added "svg" to a content filter to drop attachments with this file type as it is currently being seen with malware. The issue we have is if it is directly attached to an email, we want to drop it, but our filter is dropping many other Microsoft documents with embedded "svg" files like Powerpoint, Excel, Word which are legitimate. Is there a way to only drop attachments that are directly attached and not if they are embedded in another document type?
Content Filter:
Condition: Attachment File Info:
FileName ends with
(?i)\.(iso|slk|iqy|com|exe| ........ library-ms|svg)
Action
Strip Attachment by file info
(?i)\.(iso|slk|iqy|com|exe| ........ library-ms|svg)
