---
id: 8120
title: "An Approach to Bypassing Mail Filters"
source_domain: netspi.com
source_url: "https://www.netspi.com/blog/technical-blog/red-teaming/bypassing-mail-filters/"
published_at: "2018-09-10T00:00:00Z"
tags: ["red-team", "evasion", "initial-access", "email-filter", "macro", "docm", "magic-bytes"]
phying_url: "https://phying.com/item/8120"
lang: en
---

# An Approach to Bypassing Mail Filters

## Summary

Will Pearce shows that nulling the first bytes of a docm file lets spam filters deliver it despite block rules; Word's repair restores the file and the embedded macro still executes.

## Intelligence Metadata

- **Sources:** netspi.com
- **Published:** 2018-09-10T00:00:00Z
- **Original:** https://www.netspi.com/blog/technical-blog/red-teaming/bypassing-mail-filters/
- **Phying News:** https://phying.com/item/8120