On Sat, 24 Mar 2012, RW wrote:
On Sat, 24 Mar 2012 16:39:51 +0530
Swati Rananaware wrote:
Sorry for bothering you guys.
Found answer to my question:
body BODY_RULE_1 /[::blank::]/
That will hit any body with a space or tab in it.
It's going to be rather hard to check for a blank body, as
On Sat, 24 Mar 2012 16:39:51 +0530
Swati Rananaware wrote:
> Sorry for bothering you guys.
> Found answer to my question:
>
> body BODY_RULE_1 /[::blank::]/
That will hit any body with a space or tab in it.
Sorry for bothering you guys.
Found answer to my question:
Cool.. this should be part of the stock SA rules
--
Michael Scheidell, CTO
o: 561-999-5000
d: 561-948-2259
>*| *SECNAP Network Security Corporation
* Best Mobile Solutions Product of 2011
* Best Intrusion Prevention Product
*
On Fri, 23 Mar 2012 18:38:37 -0700
Richard Doyle wrote:
> On 03/23/2012 11:23 AM, RW wrote:
> > On Fri, 23 Mar 2012 11:54:47 -0400
> > Kiryl Hakhovich wrote:
> >
> >
> >>
> >> so here is my observation is that when email come spamd does less
> >> rules checking or something??? vs when i ran it man
Sorry for bothering you guys.
Found answer to my question:
body BODY_RULE_1 /[::blank::]/
describe BODY_RULE_1 blank mail body
score BODY_RULE_1 1.0
mimeheader MIMEHEADER_RULE_01 Content-Type =~ /multipart\/mixed/i
describe MIMEHEADER_RULE_01 Attachments
score MIMEHEADER_RULE_01 0.5
meta META_RU
