Block PDF attachment embedded with Javascript

Question

Hi All,

Trust you are doing well.

I am currently working on how to protect my mail server from different types of attachments which can prove to be malicious and cause security breaches. There is a particular file that I am unable to block the below file

A PDF attachment containing embebbed JavaScript (The Javascript is not malicious, it is only a popup message box when the PDF opens)

The file extension is .pdf but has embedded JS inside

Would appreciate your help in blocking PDF attachment containing embedded JavaScript.

Thank You

Shailesh

Answer 1

Hi shaileshmungur

Apologies for the late response was OOF for some days.

After doing more research regarding this, I found that if you want to only block PDF files embedded with a javascript, you will have to write a VBA code that will help detect if there is a JavaScript file in the PDF so that it may be blocked if any is found. However regarding the VBA we have a team that is dedicated to this, please feel free to post your query in All Questions - Microsoft Q&A

Your understanding is highly appreciated.

Kind Regards,

Momo

Answer 2

Dear Momo,

Any update on the solution please.

Thank You

Shailesh

Answer 3

Dear Momo,

Thank you for your response.

I would like to block any PDF that contains embedded JavaScript.

Normal PDF (.pdf) should be allowed to reach the users.

If i put a rule to block .pdf then normal pdf not containing embedded Javascript would be blocked as well.

Your help would be appreciated in helping me blocking a PDF that contains embedded Javascript only.

Thank You

Shailesh

Answer 4

Hi shaileshmungur

Greetings

Thank you for posting in Microsoft Community.

Transport rules can be used to achieve this, one must be an admin to achieve this and its done in the exchange admin center:

#In the Exchange admin center, select mail flow then select rules

Click on the + sign then click on  create new rule option

In the New rule window , add the name of the rule

Select a condition for the rule and click the apply this rule list, and select any attachment, and then click file extensions includes these words.

In the Specify words or phrases window, type the file name if it's a specific file that you want to block, then add the file name to the extension list, then click okay.

#On the Do the following list, select the Block message option then either select the delete the message without notifying anyone or Reject the message and include explanation.

#then click save

For more information on transport rules you may refer to Mail flow rules (transport rules) in Exchange Online | Microsoft Docs

Kind Regards,

Momo