I have seen several instances of CVE-2017-11882 malware attachments.

Does anyone have experience writing checks to detect this?