Is there a way to block embedded links in Worddocuments?
Reason is the embedding of malware in word documents in this On Dridex and a new "Zero-Day-Distribution" method link.
So far, we created a filter which detects the content oleObject#.bin in Office files, but we only had false positives so far (embedded msg, ...):
AttachmentFilterBinInOfficeAttachment:
if (attachment-filename == "(?i)\\.(doc|dot|docx|dotx|dotm|docm|rtf|xls|xlsx|xlt|xla|xltx|xlsm|xltm|xlam|xlsb|ppt|pot|pps|ppa|pptx|potx|ppsx|ppam|pptm|potm|ppsm)$") AND
(attachment-binary-contains("(?i)/embeddings/oleObject[0-9]+.bin"))
{
log-entry("MATCHED FILTER ATTACHMENT $MatchedContent");
}