[clamav-users] need to make a signature that matches word documents with a specific piece of metadata

[G.W. Haywood]

Hi there,

On Sun, 26 Jan 2020, Jon 'Boli' Copeland wrote:

> could anyone help me make a signature that matches all docx word documents 
> with the metadata item "Last Saved By" matching a specific string - you could 
> use "ABCDEF" as an example.

See for example

https://www.clamav.net/documents/creating-signatures-for-clamav
http://www.clamav.net/documents/body-based-signature-content-format

> i guess i need to somehow treat them as archives/zip and unpack/scan within

See for example the clamd.conf 'man' page.

-- 

73,
Ged.