These file formats are can be considerd for the blocklist of the Attachment Blocker because they are common threat vectors for malware. The list is not exhaustive. Each administrator decides which file types to block, because blocking all of them could disrupt workflows.
The Attachment Blocker handles both file extensions and MIME types, and identifies the real MIME type if the file extension was changed. Separate blocklists exist for extensions and MIME types and can be used independently.
Note: Do not block generic MIME types such as text/plain or application/octet-stream. Several entries below, such as scripts and PowerShell files, share generic MIME types. For these entries, use the extension blocklist rather than the MIME blocklist. MIME types are practical reference values.
Overview by security section
|
Security section |
Entries |
|---|---|
|
Executable |
14 |
|
Installer/package |
13 |
|
Script/command |
25 |
|
Shortcut/config/help |
12 |
|
Active document |
20 |
|
Archive/container |
12 |
|
Disk/virtual image |
4 |
|
Total |
100 |
Executable
|
# |
Security section |
Extension |
File type |
Canonical / practical MIME type |
Primary security reason |
|---|---|---|---|---|---|
|
1 |
Executable |
|
Windows executable |
|
Native code execution |
|
2 |
Executable |
|
Windows dynamic-link library |
|
Loadable native code |
|
3 |
Executable |
|
DOS/Windows command executable |
|
Direct code execution |
|
4 |
Executable |
|
Windows screen saver executable |
|
PE executable disguised as screen saver |
|
5 |
Executable |
|
Windows Control Panel item |
|
Loads executable control-panel code |
|
6 |
Executable |
|
Windows driver |
|
Kernel or driver code |
|
7 |
Executable |
|
Legacy Windows virtual driver |
|
Driver-level executable code |
|
8 |
Executable |
|
Windows program information file |
|
Can launch a program |
|
9 |
Executable |
|
Linux/Unix ELF executable |
|
Native code execution |
|
10 |
Executable |
|
Unix/Linux shared library |
|
Loadable native code |
|
11 |
Executable |
|
macOS dynamic library |
|
Loadable native code |
|
12 |
Executable |
|
macOS kernel extension |
|
Kernel extension code |
|
13 |
Executable |
|
Java class bytecode |
|
Executable JVM bytecode |
|
14 |
Executable |
|
Android Dalvik executable |
|
Executable Android bytecode |
Installer/package
|
# |
Security section |
Extension |
File type |
Canonical / practical MIME type |
Primary security reason |
|---|---|---|---|---|---|
|
15 |
Installer/package |
|
Windows Installer package |
|
Installs software or code |
|
16 |
Installer/package |
|
Windows Installer patch |
|
Modifies installed software |
|
17 |
Installer/package |
|
Windows Installer transform |
|
Changes installer behavior |
|
18 |
Installer/package |
|
Windows MSIX package |
|
Installs Windows applications |
|
19 |
Installer/package |
|
Windows AppX package |
|
Installs Windows applications |
|
20 |
Installer/package |
|
Windows AppX bundle |
|
Bundles installable applications |
|
21 |
Installer/package |
|
Android application package |
|
Installs Android applications |
|
22 |
Installer/package |
|
Java archive |
|
May execute Java code |
|
23 |
Installer/package |
|
Java Network Launch Protocol |
|
Launches Java application |
|
24 |
Installer/package |
|
Debian software package |
|
Installs Linux software |
|
25 |
Installer/package |
|
RPM software package |
|
Installs Linux software |
|
26 |
Installer/package |
|
ClickOnce deployment manifest |
|
Launches ClickOnce deployment |
|
27 |
Installer/package |
|
ClickOnce application reference |
|
Launches ClickOnce application |
Script/command
|
# |
Security section |
Extension |
File type |
Canonical / practical MIME type |
Primary security reason |
|---|---|---|---|---|---|
|
28 |
Script/command |
|
Windows batch script |
|
Command execution |
|
29 |
Script/command |
|
Windows command script |
|
Command execution |
|
30 |
Script/command |
|
PowerShell script |
|
PowerShell code execution |
|
31 |
Script/command |
|
PowerShell module |
|
Importable PowerShell code |
|
32 |
Script/command |
|
PowerShell data/module manifest |
|
Can influence PowerShell loading |
|
33 |
Script/command |
|
PowerShell formatting/types file |
|
PowerShell configuration content |
|
34 |
Script/command |
|
VBScript |
|
Windows Script Host execution |
|
35 |
Script/command |
|
Encoded VBScript |
|
Obfuscated script execution |
|
36 |
Script/command |
|
JavaScript source |
|
Script execution via host or browser |
|
37 |
Script/command |
|
Encoded JScript |
|
Obfuscated script execution |
|
38 |
Script/command |
|
JavaScript module |
|
Script or module execution |
|
39 |
Script/command |
|
Windows Script File |
|
Can combine executable scripts |
|
40 |
Script/command |
|
Windows Script Host settings |
|
Controls script execution |
|
41 |
Script/command |
|
Windows Script Component |
|
Executable script component |
|
42 |
Script/command |
|
HTML Application |
|
HTML or Active Script execution |
|
43 |
Script/command |
|
Unix shell script |
|
Shell command execution |
|
44 |
Script/command |
|
C shell script |
|
Shell command execution |
|
45 |
Script/command |
|
Korn shell script |
|
Shell command execution |
|
46 |
Script/command |
|
Python script |
|
Python code execution |
|
47 |
Script/command |
|
Python GUI script |
|
Python code execution |
|
48 |
Script/command |
|
Compiled Python bytecode |
|
Executable Python bytecode |
|
49 |
Script/command |
|
Perl script |
|
Perl code execution |
|
50 |
Script/command |
|
PHP script |
|
Server-side code if deployed |
|
51 |
Script/command |
|
BASIC source/script |
|
May execute in BASIC host |
|
52 |
Script/command |
|
Visual Basic source |
|
Compilable or executable code |
Shortcut/config/help
|
# |
Security section |
Extension |
File type |
Canonical / practical MIME type |
Primary security reason |
|---|---|---|---|---|---|
|
53 |
Shortcut/config/help |
|
Windows library description |
|
Can reference remote locations |
|
54 |
Shortcut/config/help |
|
Windows saved search |
|
Can reference remote locations |
|
55 |
Shortcut/config/help |
|
Windows settings shortcut |
|
Opens privileged settings surfaces |
|
56 |
Shortcut/config/help |
|
XAML browser application |
|
Can launch managed browser application |
|
57 |
Shortcut/config/help |
|
Compiled HTML Help |
|
May contain active content or links |
|
58 |
Shortcut/config/help |
|
Windows Help file |
|
Legacy active help format |
|
59 |
Shortcut/config/help |
|
Microsoft Management Console file |
|
Loads administrative snap-in configuration |
|
60 |
Shortcut/config/help |
|
Windows Registry script |
|
Modifies Registry |
|
61 |
Shortcut/config/help |
|
Windows setup information |
|
Can install or configure components |
|
62 |
Shortcut/config/help |
|
Windows Explorer command file |
|
Can invoke shell actions or remote paths |
|
63 |
Shortcut/config/help |
|
Windows scriptlet |
|
Executable script component |
|
64 |
Shortcut/config/help |
|
MHTML web archive |
|
May carry active web content |
Active document
|
# |
Security section |
Extension |
File type |
Canonical / practical MIME type |
Primary security reason |
|---|---|---|---|---|---|
|
65 |
Active document |
|
Macro-enabled Word document |
|
Embedded VBA macros |
|
66 |
Active document |
|
Macro-enabled Word template |
|
Embedded VBA macros or template abuse |
|
67 |
Active document |
|
Macro-enabled Excel workbook |
|
Embedded VBA macros |
|
68 |
Active document |
|
Excel binary workbook |
|
May contain macros or embedded objects |
|
69 |
Active document |
|
Excel add-in |
|
Loads add-in code |
|
70 |
Active document |
|
Macro-enabled Excel template |
|
Embedded VBA macros |
|
71 |
Active document |
|
Macro-enabled PowerPoint |
|
Embedded VBA macros |
|
72 |
Active document |
|
Macro-enabled PowerPoint template |
|
Embedded VBA macros or template abuse |
|
73 |
Active document |
|
Macro-enabled PowerPoint slideshow |
|
Embedded VBA macros |
|
74 |
Active document |
|
PowerPoint add-in |
|
Loads add-in code |
|
75 |
Active document |
|
Macro-enabled PowerPoint slide |
|
Embedded VBA macros |
|
76 |
Active document |
|
Excel add-in library |
|
Native add-in code |
|
77 |
Active document |
|
Legacy Word document |
|
Macros, OLE objects, or exploits |
|
78 |
Active document |
|
Legacy Excel workbook |
|
Macros, formulas, OLE, or exploits |
|
79 |
Active document |
|
Legacy PowerPoint presentation |
|
Macros, OLE objects, or exploits |
|
80 |
Active document |
|
Rich Text Format |
|
OLE objects or parser exploits |
|
81 |
Active document |
|
Excel Web Query |
|
Fetches remote data and can aid payload delivery |
|
82 |
Active document |
|
Legacy Excel add-in |
|
Loads macro or add-in code |
|
83 |
Active document |
|
Legacy PowerPoint add-in |
|
Loads add-in code |
|
84 |
Active document |
|
OneNote notebook |
|
Embedded files, scripts, and links can be launched by user click |
Archive/container
|
# |
Security section |
Extension |
File type |
Canonical / practical MIME type |
Primary security reason |
|---|---|---|---|---|---|
|
85 |
Archive/container |
|
ZIP archive |
|
Can conceal nested or blocked payloads |
|
86 |
Archive/container |
|
RAR archive |
|
Can conceal nested or encrypted payloads |
|
87 |
Archive/container |
|
7-Zip archive |
|
Can conceal nested or encrypted payloads |
|
88 |
Archive/container |
|
TAR archive |
|
Bundles nested payloads |
|
89 |
Archive/container |
|
Gzip-compressed file |
|
Compresses or conceals payload |
|
90 |
Archive/container |
|
Bzip2-compressed file |
|
Compresses or conceals payload |
|
91 |
Archive/container |
|
XZ-compressed file |
|
Compresses or conceals payload |
|
92 |
Archive/container |
|
LZH archive |
|
Can conceal nested payloads |
|
93 |
Archive/container |
|
ACE archive |
|
Legacy archive; can conceal payloads |
|
94 |
Archive/container |
|
ARJ archive |
|
Legacy archive; can conceal payloads |
|
95 |
Archive/container |
|
Microsoft Cabinet archive |
|
Packages installers or executables |
|
96 |
Archive/container |
|
Outlook personal folder |
|
Mailbox container that can hide nested attachments and support data exfiltration |
Disk/virtual image
|
# |
Security section |
Extension |
File type |
Canonical / practical MIME type |
Primary security reason |
|---|---|---|---|---|---|
|
97 |
Disk/virtual image |
|
ISO disk image |
|
Can mount and hide executable payloads |
|
98 |
Disk/virtual image |
|
Raw/FAT disk image |
|
Can contain mountable payloads |
|
99 |
Disk/virtual image |
|
Apple disk image |
|
Can deliver macOS applications or installers |
|
100 |
Disk/virtual image |
|
Virtual hard disk |
|
Can contain mountable payloads |