I use FDM for this. Appropriate parts of my ".fdm.conf":
# Where the bad stuff goes.
action "spam" mbox "%h/Mail/spam"
# Some attachments indicate spam just by existing.
$bad_ext = "*.xlsm"
match attachment any-name "*.xlsm" action "spam"
# Run through spamassassin if not too large.
match size < 500K action rewrite "/usr/local/bin/spamc" continue
# If spamassassin thinks it's spam then good enough for me.
match "^X-Spam-Status: Yes" in headers action "spam"