FM / etc

/etc

Name	Size	Mode	Actions
alsa/	-	0755	rm
alternatives/	-	0755	rm
apache2/	-	0755	rm
audit/	-	0750	rm
authselect/	-	0755	rm
bash_completion.d/	-	0755	rm
binfmt.d/	-	0755	rm
bluetooth/	-	0555	rm
cagefs/	-	0755	rm
chkconfig.d/	-	0755	rm
chkserv.d/	-	0755	rm
cifs-utils/	-	0755	rm
cl.selector/	-	0755	rm
cpanel/	-	0751	rm
cron.d/	-	0755	rm
cron.daily/	-	0755	rm
cron.hourly/	-	0755	rm
cron.monthly/	-	0755	rm
cron.weekly/	-	0755	rm
crypto-policies/	-	0755	rm
dbus-1/	-	0755	rm
dconf/	-	0755	rm
debuginfod/	-	0755	rm
default/	-	0755	rm
depmod.d/	-	0755	rm
dhcp/	-	0755	rm
dnf/	-	0755	rm
dovecot/	-	0755	rm
dpkg/	-	0755	rm
dracut.conf.d/	-	0755	rm
egl/	-	0755	rm
environment-modules/	-	0755	rm
exports.d/	-	0755	rm
firewalld/	-	0750	rm
flatpak/	-	0755	rm
fonts/	-	0755	rm
fwupd/	-	0755	rm
gcrypt/	-	0755	rm
geoclue/	-	0755	rm
glvnd/	-	0755	rm
gnupg/	-	0755	rm
groff/	-	0755	rm
grub.d/	-	0700	rm
gss/	-	0755	rm
gssproxy/	-	0755	rm
ImageMagick-6/	-	0755	rm
imunify-agent-proxy/	-	0700	rm
imunify360/	-	0755	rm
init.d/	-	0755	rm
iproute2/	-	0755	rm
issue.d/	-	0755	rm
kdump/	-	0755	rm
kernel/	-	0755	rm
keys/	-	0755	rm
keyutils/	-	0755	rm
krb5.conf.d/	-	0755	rm
ld.so.conf.d/	-	0755	rm
libibverbs.d/	-	0755	rm
libnl/	-	0755	rm
libpaper.d/	-	0755	rm
libreport/	-	0755	rm
libssh/	-	0755	rm
logrotate.d/	-	0755	rm
lvm/	-	0755	rm
lynis/	-	0755	rm
mail/	-	0755	rm
microcode_ctl/	-	0755	rm
modprobe.d/	-	0755	rm
modulefiles/	-	0755	rm
modules-load.d/	-	0755	rm
motd.d/	-	0755	rm
my.cnf.d/	-	0755	rm
named/	-	0750	rm
needrestart/	-	0755	rm
NetworkManager/	-	0755	rm
nftables/	-	0700	rm
nginx/	-	0755	rm
openldap/	-	0755	rm
opt/	-	0755	rm
ostree/	-	0755	rm
pam.d/	-	0755	rm
pcp/	-	0755	rm
pdns/	-	0755	rm
pkcs11/	-	0755	rm
pkgconfig/	-	0755	rm
pki/	-	0755	rm
pm/	-	0755	rm
polkit-1/	-	0755	rm
popt.d/	-	0755	rm
profile.d/	-	0755	rm
proftpd/	-	0751	rm
pulse/	-	0755	rm
pure-ftpd/	-	0755	rm
rc.d/	-	0755	rm
rc0.d/	-	0755	rm
rc1.d/	-	0755	rm
rc2.d/	-	0755	rm
rc3.d/	-	0755	rm
rc4.d/	-	0755	rm
rc5.d/	-	0755	rm
rc6.d/	-	0755	rm
request-key.d/	-	0755	rm
rpm/	-	0755	rm
rsyslog.d/	-	0755	rm
rwtab.d/	-	0755	rm
samba/	-	0755	rm
sasl2/	-	0755	rm
scl/	-	0755	rm
security/	-	0755	rm
selinux/	-	0755	rm
sgml/	-	0755	rm
skel/	-	0755	rm
smartmontools/	-	0755	rm
ssh/	-	0755	rm
ssl/	-	0755	rm
sssd/	-	0700	rm
statetab.d/	-	0755	rm
sudoers.d/	-	0750	rm
sw-engine/	-	0755	rm
sysconfig/	-	0755	rm
sysctl.d/	-	0755	rm
systemd/	-	0755	rm
terminfo/	-	0755	rm
tmpfiles.d/	-	0755	rm
tpm2-tss/	-	0755	rm
udev/	-	0755	rm
UPower/	-	0755	rm
valiases/	-	0751	rm
vdomainaliases/	-	0751	rm
vfilters/	-	0751	rm
vmware-tools/	-	0755	rm
vulkan/	-	0755	rm
wireplumber/	-	0755	rm
X11/	-	0755	rm
xdg/	-	0755	rm
xml/	-	0755	rm
yum/	-	0755	rm
yum.repos.d/	-	0755	rm
.pwd.lock	0	0600	edit dl rm
.updated	208	0644	edit dl rm
.whostmgrft	0	0644	edit dl rm
adjtime	16	0644	edit dl rm
agent360-token.ini	72	0640	edit dl rm
agent360.ini	962	0640	edit dl rm
agent360.ini.rpmnew	817	0600	edit dl rm
agent360.ini.rpmsave	951	0640	edit dl rm
aliases	1529	0644	edit dl rm
almalinux-release	37	0644	edit dl rm
anacrontab	541	0644	edit dl rm
antivirus.exim	10634	0644	edit dl rm
asound.conf	55	0644	edit dl rm
at.deny	1	0644	edit dl rm
backupmxhosts	0	0640	edit dl rm
bashrc	3459	0644	edit dl rm
bindresvport.blacklist	535	0644	edit dl rm
blocked_incoming_email_countries	0	0640	edit dl rm
blocked_incoming_email_country_ips	0	0640	edit dl rm
blocked_incoming_email_domains	0	0640	edit dl rm
chrony.conf	1374	0644	edit dl rm
chrony.keys	540	0640	edit dl rm
cpanel_exim_system_filter	12144	0644	edit dl rm
cpanel_mail_netblocks	15	0640	edit dl rm
cpbackup-exclude.conf	147	0644	edit dl rm
cpsources.conf.plugins.example	2843	0644	edit dl rm
cpspamd.conf	0	0644	edit dl rm
cpupdate.conf	111	0644	edit dl rm
cron.deny	7	0644	edit dl rm
crontab	451	0644	edit dl rm
crypttab	0	0600	edit dl rm
csh.cshrc	1401	0644	edit dl rm
csh.login	1112	0644	edit dl rm
dbowners	773	0640	edit dl rm
demodomains	0	0640	edit dl rm
demouids	0	0640	edit dl rm
demousers	0	0640	edit dl rm
digestshadow	0	0640	edit dl rm
DIR_COLORS	4673	0644	edit dl rm
DIR_COLORS.lightbgcolor	4755	0644	edit dl rm
domainips	83	0644	edit dl rm
domainusers	1004	0640	edit dl rm
domain_remote_mx_ips.cdb	6406	0640	edit dl rm
dracut.conf	117	0644	edit dl rm
email_send_limits	3497	0640	edit dl rm
environment	0	0644	edit dl rm
ethertypes	1362	0644	edit dl rm
exim.conf	88651	0644	edit dl rm
exim.conf.dist	26408	0644	edit dl rm
exim.conf.localopts	2093	0644	edit dl rm
exim.conf.localopts.shadow	0	0600	edit dl rm
exim.conf.mailman2.dist	29729	0644	edit dl rm
exim.conf.mailman2.exiscan.dist	29904	0644	edit dl rm
exim.crt	5679	0660	edit dl rm
exim.key	1679	0660	edit dl rm
exim.pl	231	0644	edit dl rm
exim.pl.local	498977	0644	edit dl rm
eximmailtrap	0	0644	edit dl rm
eximrejects	163	0644	edit dl rm
eximrejects.rpmorig	367	0644	edit dl rm
exim_suspended_list	715	0640	edit dl rm
exim_trusted_configs	24	0644	edit dl rm
exports	0	0644	edit dl rm
favicon.png	226	0644	edit dl rm
filesystems	66	0644	edit dl rm
freetds.conf	1154	0644	edit dl rm
fstab	786	0644	edit dl rm
ftpd-ca.pem	0	0660	edit dl rm
ftpd-rsa-key.pem	1679	0660	edit dl rm
ftpd-rsa.pem	5679	0660	edit dl rm
fuse.conf	38	0644	edit dl rm
GREP_COLORS	94	0644	edit dl rm
greylist_common_mail_providers	69722	0644	edit dl rm
greylist_trusted_netblocks	0	0640	edit dl rm
group	1888	0644	edit dl rm
group-	1873	0644	edit dl rm
grub2-efi.cfg	-	0	edit dl rm
grub2.cfg	-	0	edit dl rm
gshadow	1537	0600	edit dl rm
gshadow-	1526	0600	edit dl rm
host.conf	9	0644	edit dl rm
hostname	26	0644	edit dl rm
hosts	219	0644	edit dl rm
idmapd.conf	5799	0644	edit dl rm
inittab	490	0644	edit dl rm
inputrc	943	0644	edit dl rm
ipaddrpool	69	0644	edit dl rm
ips	254	0644	edit dl rm
issue	23	0644	edit dl rm
issue.net	22	0644	edit dl rm
kdump.conf	9077	0644	edit dl rm
krb5.conf	880	0644	edit dl rm
ld.so.cache	39079	0644	edit dl rm
ld.so.conf	28	0644	edit dl rm
libaudit.conf	191	0640	edit dl rm
libuser.conf	2391	0644	edit dl rm
localaliases	48	0644	edit dl rm
localdomains	1516	0640	edit dl rm
localdomains.rpmnew	0	0644	edit dl rm
locale.conf	15	0644	edit dl rm
locales.conf	370	0644	edit dl rm
localtime	3552	0644	edit dl rm
lock_manager_local.ini	829	0644	edit dl rm
login.defs	7779	0644	edit dl rm
logrotate.conf	496	0644	edit dl rm
machine-id	33	0444	edit dl rm
magic	111	0644	edit dl rm
mailbox_formats	689	0640	edit dl rm
mailcap	272	0644	edit dl rm
mailhelo	28	0640	edit dl rm
mailips	0	0640	edit dl rm
makedumpfile.conf.sample	5122	0644	edit dl rm
manualmx	1	0640	edit dl rm
man_db.conf	5235	0644	edit dl rm
mime.types	67454	0644	edit dl rm
mke2fs.conf	1208	0644	edit dl rm
motd	0	0644	edit dl rm
mtab	0	0444	edit dl rm
my.cnf	1480	0644	edit dl rm
named.conf	18103	0644	edit dl rm
named.conf.cache	2340	0600	edit dl rm
named.conf.precpanelinstall	1739	0640	edit dl rm
named.conf.prerebuilddnsconfig	3515	0644	edit dl rm
named.conf.rebuilddnsconfig	3515	0644	edit dl rm
named.conf.zonedir.cache	57	0600	edit dl rm
named.rfc1912.zones	1029	0640	edit dl rm
named.root.key	686	0644	edit dl rm
nanorc	10373	0644	edit dl rm
neighbor_netblocks	46	0644	edit dl rm
netconfig	767	0644	edit dl rm
networks	58	0644	edit dl rm
nfs.conf	1651	0644	edit dl rm
nfsmount.conf	3604	0644	edit dl rm
nocgiusers	11	0640	edit dl rm
nscd.conf	2729	0644	edit dl rm
nsswitch.conf	2124	0644	edit dl rm
nsswitch.conf.bak	2108	0644	edit dl rm
odbc.ini	0	0644	edit dl rm
odbcinst.ini	1896	0644	edit dl rm
os-release	572	0644	edit dl rm
outgoing_mail_hold_users	0	0640	edit dl rm
outgoing_mail_suspended_users	25	0640	edit dl rm
papersize	68	0644	edit dl rm
passwd	5564	0644	edit dl rm
passwd-	5521	0644	edit dl rm
passwd.cache	31419	0600	edit dl rm
passwd.nouids.cache	16197	0600	edit dl rm
pcp.conf	7338	0644	edit dl rm
pool.conf	219	0644	edit dl rm
printcap	233	0644	edit dl rm
profile	2700	0644	edit dl rm
protocols	6568	0644	edit dl rm
pure-ftpd.conf	11108	0600	edit dl rm
pure-ftpd.pem	7358	0660	edit dl rm
rc.local	474	0644	edit dl rm
recent_authed_mail_ips	29	0644	edit dl rm
recent_authed_mail_ips_users	209	0644	edit dl rm
recent_recipient_mail_server_ips	1051	0640	edit dl rm
redhat-release	37	0644	edit dl rm
relayhosts	29	0644	edit dl rm
relayhostsusers	209	0644	edit dl rm
remotedomains	253	0644	edit dl rm
request-key.conf	1787	0644	edit dl rm
resolv.conf	102	0644	edit dl rm
rpc	1634	0644	edit dl rm
rsyncd.conf	458	0644	edit dl rm
rsyslog.conf	3300	0644	edit dl rm
s-nail.rc	9624	0444	edit dl rm
secondarymx	0	0640	edit dl rm
senderverifybypasshosts	0	0640	edit dl rm
services	692252	0644	edit dl rm
sestatus.conf	216	0644	edit dl rm
shadow	6097	0600	edit dl rm
shadow-	6097	0600	edit dl rm
shadow.nouids.cache	19754	0600	edit dl rm
shells	128	0644	edit dl rm
skipsmtpcheckhosts	0	0640	edit dl rm
spammeripblocks	0	0640	edit dl rm
spammers	0	0644	edit dl rm
ssldomains	0	0600	edit dl rm
stats.conf	37	0644	edit dl rm
subgid	20	0644	edit dl rm
subgid-	0	0644	edit dl rm
subuid	20	0644	edit dl rm
subuid-	0	0644	edit dl rm
sudo-ldap.conf	3181	0640	edit dl rm
sudo.conf	4356	0640	edit dl rm
sudoers	4328	0440	edit dl rm
sysctl.conf	449	0644	edit dl rm
system-release	37	0644	edit dl rm
system-release-cpe	37	0644	edit dl rm
trueuserdomains	1004	0640	edit dl rm
trueuserowners	637	0640	edit dl rm
trusted-key.key	375	0644	edit dl rm
trustedmailhosts	0	0640	edit dl rm
trusted_mail_users	0	0640	edit dl rm
userbwlimits	730	0640	edit dl rm
userdatadomains	12385	0640	edit dl rm
userdatadomains.json	13548	0640	edit dl rm
userdomains	2609	0640	edit dl rm
userips	852	0640	edit dl rm
userplans	780	0640	edit dl rm
vconsole.conf	28	0644	edit dl rm
virc	1184	0644	edit dl rm
webspam	0	0644	edit dl rm
wgetrc	4925	0644	edit dl rm
wwwacct.conf	257	0644	edit dl rm
wwwacct.conf.cache	326	0644	edit dl rm
wwwacct.conf.shadow	86	0600	edit dl rm
wwwacct.conf.shadow.cache	436	0600	edit dl rm
xattr.conf	817	0644	edit dl rm
yum.conf	216	0644	edit dl rm

Edit: /etc/cpanel_exim_system_filter (12144B)

# Exim filter
# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
#  cPanel System Filter for EXIM                                                                                #
#  VERSION = 2.0                                                                                                #
# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
#   !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!DO NOT MODIFY THIS FILE DIRECTLY!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!      #
# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
#   Direct modifications to the /etc/cpanel_exim_system_filter file will be lost when the configuration is      #
#   next rebuilt. To have modifications retained, please use one of the following options:                      #
#                                                                                                               #
#    1)                                                                                                         #
#      * Place each sysfilter block you wish to include in a unique file at:                                    #
#            /usr/local/cpanel/etc/exim/sysfilter/options/                                                      #
#      * Enable or disable the custom block in WHM using:                                                       #
#          Service Configuration => Exim Configuration Manager => Filters => Custom Filter: [your unique file]  #
#                                                                                                               #
#    2)                                                                                                         #
#      * Create a custom sysfilter file in /etc/                                                                #
#      * Change the location of the sysfilter file in WHM using:                                                #
#          Service Configuration => Exim Configuration Manager => Filters => System Filter File                 #
#                                                                                                               #
# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
#   !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!DO NOT MODIFY THIS FILE DIRECTLY!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!      #
# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
#                                                                                                               #
#  Only process once                                                                                            #
#                                                                                                               #
# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
if not first_delivery
then
  finish
endif
# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
#                                                                                                               #
#  Ignore "real" errors                                                                                         #
#                                                                                                               #
# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
if error_message and $header_from: contains "Mailer-Daemon@"
then
  finish
endif
# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #

# BEGIN - Included from /usr/local/cpanel/etc/exim/sysfilter/options/attachments
# (Use the Basic Editor in the Exim Configuration Manager in WHM to change)
# or manually edit /etc/exim.conf.localopts and run /scripts/buildeximconf
## -----------------------------------------------------------------------
# Look for single part MIME messages with suspicious name extensions
# Check Content-Type header using quoted filename [content_type_quoted_fn_match]
if $header_content-type: matches "(?:file)?name=(\"[^\"]+\\\\.(?:ad[ep]|ba[st]|chm|cmd|com|cpl|crt|eml|exe|hlp|hta|in[fs]|isp|jse?|lnk|md[be]|ms[cipt]|pcd|pif|reg|scr|sct|shs|url|vb[se]|ws[fhc])\")"
then
  fail text "This message has been rejected because it has\n\
	     potentially executable content $1\n\
	     This form of attachment has been used by\n\
             recent viruses or other malware.\n\
	     If you meant to send this file then please\n\
	     package it up as a zip file and resend it."
  seen finish
endif
# same again using unquoted filename [content_type_unquoted_fn_match]
if $header_content-type: matches "(?:file)?name=(\\\\S+\\\\.(?:ad[ep]|ba[st]|chm|cmd|com|cpl|crt|eml|exe|hlp|hta|in[fs]|isp|jse?|lnk|md[be]|ms[cipt]|pcd|pif|reg|scr|sct|shs|url|vb[se]|ws[fhc]))([\\\\s;]|\\$)"
then
  fail text "This message has been rejected because it has\n\
	     potentially executable content $1\n\
	     This form of attachment has been used by\n\
             recent viruses or other malware.\n\
	     If you meant to send this file then please\n\
	     package it up as a zip file and resend it."
  seen finish
endif

## -----------------------------------------------------------------------
# Attempt to catch embedded VBS attachments
# in emails.   These were used as the basis for
# the ILOVEYOU virus and its variants - many many varients
# Quoted filename - [body_quoted_fn_match]
if $message_body matches "(?:Content-(?:Type:(?>\\\\s*)[\\\\w-]+/[\\\\w-]+|Disposition:(?>\\\\s*)attachment);(?>\\\\s*)(?:file)?name=|begin(?>\\\\s+)[0-7]{3,4}(?>\\\\s+))(\"[^\"]+\\\\.(?:ad[ep]|ba[st]|chm|cmd|com|cpl|crt|eml|exe|hlp|hta|in[fs]|isp|jse?|lnk|md[be]|ms[cipt]|pcd|pif|reg|scr|sct|shs|url|vb[se]|ws[fhc])\")[\\\\s;]"
then
  fail text "This message has been rejected because it has\n\
	     a potentially executable attachment $1\n\
	     This form of attachment has been used by\n\
             recent viruses or other malware.\n\
	     If you meant to send this file then please\n\
	     package it up as a zip file and resend it."
  seen finish
endif
# same again using unquoted filename [body_unquoted_fn_match]
if $message_body matches "(?:Content-(?:Type:(?>\\\\s*)[\\\\w-]+/[\\\\w-]+|Disposition:(?>\\\\s*)attachment);(?>\\\\s*)(?:file)?name=|begin(?>\\\\s+)[0-7]{3,4}(?>\\\\s+))(\\\\S+\\\\.(?:ad[ep]|ba[st]|chm|cmd|com|cpl|crt|eml|exe|hlp|hta|in[fs]|isp|jse?|lnk|md[be]|ms[cipt]|pcd|pif|reg|scr|sct|shs|url|vb[se]|ws[fhc]))[\\\\s;]"
then
  fail text "This message has been rejected because it has\n\
	     a potentially executable attachment $1\n\
	     This form of attachment has been used by\n\
             recent viruses or other malware.\n\
	     If you meant to send this file then please\n\
	     package it up as a zip file and resend it."
  seen finish
endif
## -----------------------------------------------------------------------

#### Version history
#
# 0.01 5 May 2000
#	Initial release
# 0.02 8 May 2000
#	Widened list of content-types accepted, added WSF extension
# 0.03 8 May 2000
#	Embedded the install notes in for those that don't do manuals
# 0.04 9 May 2000
#	Check global content-type header.  Efficiency mods to REs
# 0.05 9 May 2000
#	More minor efficiency mods, doc changes
# 0.06 20 June 2000
#	Added extension handling - thx to Douglas Gray Stephens & Jeff Carnahan
# 0.07 19 July 2000
#	Latest MS Outhouse bug catching
# 0.08 19 July 2000
#	Changed trigger length to 80 chars, fixed some spelling
# 0.09 29 September 2000
#	More extensions... its getting so we should just allow 2 or 3 through
# 0.10 18 January 2001
#	Removed exclusion for error messages - this is a little nasty
#	since it has other side effects, hence we do still exclude
#	on unix like error messages
# 0.11 20 March, 2001
#	Added CMD extension, tidied docs slightly, added RCS tag
#	** Missed changing version number at top of file :-(
# 0.12 10 May, 2001
#	Added HTA extension
# 0.13 22 May, 2001
#	Reformatted regexps and code to build them so that they are
#	shorter than the limits on pre exim 3.20 filters.  This will
#	make them significantly less efficient, but I am getting so
#	many queries about this that requiring 3.2x appears unsupportable.
# 0.14 15 August,2001
#	Added .lnk extension - most requested item :-)
#	Reformatted everything so its now built from a set of short
#	library files, cutting down on manual duplication.
#	Changed \w in filename detection to . - dodges locale problems
#	Explicit application of GPL after queries on license status
# 0.15 17 August, 2001
#	Changed the . in filename detect to \S (stops it going mad)
# 0.16 19 September, 2001
#	Pile of new extensions including the eml in current use
# 0.17 19 September, 2001
#	Syntax fix
#
#### Install Notes
#
# Exim filters run the exim filter language - a very primitive
# scripting language - in place of a user .forward file, or on
# a per system basis (on all messages passing through).
# The filtering capability is documented in the main set of manuals
# a copy of which can be found on the exim web site
#	http://www.exim.org/
#
# To install, copy the filter file (with appropriate permissions)
# to /etc/exim/system_filter.exim and add to your exim config file
# [location is installation depedant - typicaly /etc/exim/config ]
# in the first section the line:-
#	message_filter = /etc/exim/system_filter.exim
#	message_body_visible = 5000
#
# You may also want to set the message_filter_user & message_filter_group
# options, but they default to the standard exim user and so can
# be left untouched.  The other message_filter_* options are only
# needed if you modify this to do other functions such as deliveries.
# The main exim documentation is quite thorough and so I see no need
# to expand it here...
#
# Any message that matches the filter will then be bounced.
# If you wish you can change the error message by editing it
# in the section above - however be careful you don't break it.
#
# After install exim should be restarted - a kill -HUP to the
# daemon will do this.
#
#### LIMITATIONS
#
# This filter tries to parse MIME with a regexp... that doesn't
# work too well.  It will also only see the amount of the body
# specified in message_body_visible
#
#### BASIS
#
# The regexp that is used to pickup MIME/uuencoded body parts with
# quoted filenames is replicated below (in perl format).
# You need to remember that exim converts newlines to spaces in
# the message_body variable.
#
#	  (?:Content-					# start of content header
#	  (?:Type: (?>\s*)				# rest of c/t header
#	    [\w-]+/[\w-]+				# content-type (any)
#	    |Disposition: (?>\s*)			# content-disposition hdr
#	    attachment)					# content-disposition
#	  ;(?>\s*)					# ; space or newline
#	  (?:file)?name=				# filename=/name=
#	  |begin (?>\s+) [0-7]{3,4} (?>\s+)) 		# begin octal-mode
#	  (\"[^\"]+\.					# quoted filename.
#		(?:ad[ep]				# list of extns
#		|ba[st]
#		|chm
#		|cmd
#		|com
#		|cpl
#		|crt
#		|eml
#		|exe
#		|hlp
#		|hta
#		|in[fs]
#		|isp
#		|jse?
#		|lnk
#		|md[be]
#		|ms[cipt]
#		|pcd
#		|pif
#		|reg
#		|scr
#		|sct
#		|shs
#		|url
#		|vb[se]
#		|ws[fhc])
#	  \"						# end quote
#	  )						# end of filename capture
#	  [\s;]						# trailing ;/space/newline

#
#
### [End]
# END - Included from /usr/local/cpanel/etc/exim/sysfilter/options/attachments

# BEGIN - Included from /usr/local/cpanel/etc/exim/sysfilter/options/spam_rewrite
# (Use the Basic Editor in the Exim Configuration Manager in WHM to change)
# or manually edit /etc/exim.conf.localopts and run /scripts/buildeximconf
if "${if def:header_X-Spam-Subject: {there}}" is there
then
    headers remove Subject
    headers add "Subject: $rh_X-Spam-Subject:"
    headers remove X-Spam-Subject
endif
# END - Included from /usr/local/cpanel/etc/exim/sysfilter/options/spam_rewrite

cmd: