Whats EMZ files and can it be removed from compressed file detection?

[keithsauer507]

We recently turned on an incoming mail filter to send emails containing executable and compressed file attachments to a quarantine policy and it notifies the end user to contact IT to release the message if they are expecting it.  The notification email uses variables so the end user can see who it is from, the subject and the attachment file names.  Since turning this on we've noticed that some emails containing images have been quarantined.  We really don't care about images but usually all of a sudden we are seeing one file mixed in there with an .emz extension.  We've never seen emz files prior to turning this feature on.  Is this a new up and coming file extension?  Why would people send jpg or png but throw in one emz file to throw us off?  These type of extensions have come from different people at different companies, so they are not in cahoots.

Example:

Attachment file names: image001.png, image002.jpg, image003.emz, image004.png, image005.png, image006.png, image007.png

[dmccabej]

Hello. 

EMZ is a type of compressed file, which you can read more information about: here. 

EMZ File Format

Windows Compressed Enhanced Metafile, a graphic format used in Office and Visio

EMZ is a file extension for a compressed graphics file used by the Microsoft Office Suite and Visio. Stands for Enhanced Metafile-Zipped. Contains an EMF (Enhanced MetaFile) image file that has been compressed using GZIP compression.

MIME type: application/octet-stream

One option would be to setup your filter(s) to trigger on filename instead of file-type.

Thanks!

-Dennis M.