Attachment Scan Rules

[MROP_25]

how is working this rule executable_windows??

FortiMail Attachment Scan Rules (executable_windows), was catched this file 1.pdf:( detected by Content Filter, filetype application/javascript filename ABC.js in file ABC2 Integration Document - Phase 1.pdf, attachment scan rule: executable_windows).

but when downloaded that file to scan by Sandbox, the file was clean result??

Any one had same this problem, and was solved?

[AEK]

It seems this PDF file includes a JS script. While when scanned with Sandbox it founds the script is not harmful.

Your FML's content filter doesn't look for malware, it just block the file when it finds a JS script. Your content filter is just working as it is supposed to do.

Since you have a Sandbox, if you need to allow JS scripts that are embedded in PDF files, then your solution would be to allow JS scripts in the content filter. The Sandbox will do the rest.