[Dovecot] Sieve during read or login?

I was wondering if anyone thought of applying filters to email post
delivery, pre-read.

Basically the idea would be to head off Spam, Malware or Phishing for
already delivered email. Malware would probably be the least likely
target, as (knock on wood) user workstations would be updated, but a
targeted phishing scam would not create a public signature that would
be downloaded, yet an admin may have a regex that could be used to
remove that email before it left the server.

I used to run find and grep on my Maildirs, but that's no longer
practical. I think maybe an 'on connect', or 'on read' might be an
option.

Thoughts?

Rick