Restrict email with no text

[MattBer810964]

We have received numerous emails asking users to scan a QR code to get to a phishing page directing them to enter credentials. The email is nothing but a picture of a jpeg. Is there a way to restrict or block email that do not have text in them?

[Ken Stieers]

You'll want to test it, but a body search for
^\s*$ <= any number of whitespace characters
Or
^$ <= nothing

might work.

[MattBer810964]

Thank you for this information. We created a dictionary rule and added both of these expressions. We made a quarantine list for emails with these expressions. Every email we started to receive was getting put into these quarantines, whether they were blank or not. 

[Dustin Anderson]

We had similar about a month ago, image file, but they had a # and some numbers in the body, so we did a filter of attachment ends in jpg and body contained #[0-9][0-9][0-9] and that got most of them.