Hi Eugenio,
If you are looking for a specific javascript expression, the only solution is to use the message filter condition “attachment-binary-contains”.
However, filters such as below would not cover all kinds of javascripts inside PDF's since its not a security scanning engine.
PDF_JS_Finder: if attachment-binary-contains("^%PDF.*JavaScript/JS") {
notify ("personofinterest@company.com");
}
I do see an open internal feature request to allow thorough support for binary scanning of messages and attachments such as looking for the specific ASCII strings within PDF files that indicate the use of Javascript (""Javascript/JS"").
I would recommend using AMP scanning engines to detect malicious PDF attachments.
Regards,
Libin Varghese
