Scope:All Email Security Gateways, all firmware versions.
To block the email with copied "RLO" (Right to Left Override) UNICODE that is attached with extension temp file, please block the following content filter "Header".
Even if test[RLO]txt.exe is a EXE file, it will be shown as following TXT file, testexe.txt.
If this file is attached in the mail, mailer will encode the file name as the following.
"RLO? is the Unicode Character 'RIGHT-TO-LEFT OVERRIDE' (U+202E)?UTF-8 (hex) 0xE2 0x80 0xAE (e280ae)
So, part of "%E2%80%AE" is a RLO, so by creating a content filter for blocking this part, it will allow us to block the email.
Link to This Page: