I opened a case with Cisco, and this is their suggestion.
Hi Brad,
You can use the below filter for achieving your desired results-
The message filter as follow:
macro_MSoffice_drop:
if (attachment-filename == "(?i)\\.(xls|doc|ppt|xlsx|docx|pptx...
Matthew,
I have tried most of the filters in this thread with none of them working. I send a know xls with a macro and they don't processed with the Header X-Office Macro. here is the filter I created. what could I be doing wrong? AMP does catch it ...