I opened a case with Cisco, and this is their suggestion. Hi Brad,   You can use the below filter for achieving your desired results-   The message filter as follow: macro_MSoffice_drop: if (attachment-filename == "(?i)\\.(xls|doc|ppt|xlsx|docx|pptx...

Matthew, I have tried most of the filters in this thread with none of them working. I send a know xls with a macro and they don't processed with the Header X-Office Macro. here is the filter I created. what could I be doing wrong?  AMP does catch it ...