I have not checked if it is in standard definitions but you can define a custom yara rule to detect it:

 

https://www.us-cert.gov/ncas/alerts/TA17-132A

This was my first thought this morning. ClamAV is okay but it doesn't give me that really warm and fuzzy feeling.

 

Is anyone successfully using a command line scanner? I have SEP 12 installed on the mail server but it doesn't scan the message store nor the spool. I've tried to set up a command line option in SM to use it but it just hasn't worked. Anyone have a working command line syntax config for this? Or another good layer of protection ON the server rather than just ClamAV?

 

Matt