MIME header false positives (was Rule to score word documents)

2016-04-06 Thread Cedric Knight
On 30/03/16 21:11, @lbutlr wrote: > On Wed Mar 30 2016 13:34:23 Alex said: >> >> /^(Content-(Type|Disposition)\:|[[:space:]]+).*(file)?name="?.*\.doc"?;?$/ >> REJECT > > /^\s*Content-(Disposition|Type).*name\s*=\s*"?(.*\.(ade|adp|bas|bat|chm|cmd|com|cpl|crt|dll|exe|hlp|hta|inf|ins|isp|js|jse

Re: Rule to score word documents

2016-04-02 Thread @lbutlr
On Mar 31, 2016, at 5:24 AM, Rodney Green wrote: > I'm just looking at quarantining file attachments that could possibly have > ransomware. So… ALL file attachments? -- Experience is something you don't get until just after you need it.

Re: Rule to score word documents

2016-04-01 Thread Alex
Hi, David Funk wrote: >>> /^(Content-(Type|Disposition)\:|[[:space:]]+).*(file)?name="?.*\.doc"?;?$/ >>> >>> REJECT >>> >>> I believe something like this would work in spamassassin: >>> >>> mimeheader DOC_ATTACHED Content-Type =~ /="[^"]+\.(?:docx?|rtf)"/i >>> scoreDOC_ATTACHED 12.5 >>

Re: Rule to score word documents

2016-03-31 Thread Rodney Green
On Thu, Mar 31, 2016 at 7:24 AM Reindl Harald wrote: > > > Am 31.03.2016 um 13:16 schrieb Rodney Green: > > > > > > On Wed, Mar 30, 2016 at 3:34 PM Reindl Harald > > wrote: > > > > > > > > Am 30.03.2016 um 21:23 schrieb Rodney Green: > > > I'd like to assi

Re: Rule to score word documents

2016-03-31 Thread Rodney Green
On Wed, Mar 30, 2016 at 3:34 PM Alex wrote: > > > I believe something like this would work in spamassassin: > > mimeheader DOC_ATTACHED Content-Type =~ /="[^"]+\.(?:docx?|rtf)"/i > scoreDOC_ATTACHED 12.5 > > > Thank you! I'll give this a try, but score it lower for testing. Rod

Re: Rule to score word documents

2016-03-31 Thread Rodney Green
On Wed, Mar 30, 2016 at 4:11 PM @lbutlr wrote: > On Wed Mar 30 2016 13:34:23 Alex said: > > > > > /^(Content-(Type|Disposition)\:|[[:space:]]+).*(file)?name="?.*\.doc"?;?$/ > > REJECT > > /^\s*Content-(Disposition|Type).*name\s*=\s*"?(.*\.(ade|adp|bas|bat|chm|cmd|com|cpl|crt|dll|exe|hlp|h

Re: Rule to score word documents

2016-03-31 Thread Reindl Harald
Am 31.03.2016 um 13:16 schrieb Rodney Green: On Wed, Mar 30, 2016 at 3:34 PM Reindl Harald mailto:h.rei...@thelounge.net>> wrote: Am 30.03.2016 um 21:23 schrieb Rodney Green: > I'd like to assign a spamassassin score to received word documents > (doc,docx,xls,xlsx) so they ar

Re: Rule to score word documents

2016-03-31 Thread Rodney Green
On Wed, Mar 30, 2016 at 3:34 PM Reindl Harald wrote: > > > Am 30.03.2016 um 21:23 schrieb Rodney Green: > > I'd like to assign a spamassassin score to received word documents > > (doc,docx,xls,xlsx) so they are quarantined on my UTM. I've tried the > > following which doesn't work. Can someone sh

Re: Rule to score word documents

2016-03-30 Thread Robert Schetterer
Am 30.03.2016 um 22:34 schrieb David B Funk: > On Wed, 30 Mar 2016, Alex wrote: > >> Hi, >> >>> I'd like to assign a spamassassin score to received word documents >>> (doc,docx,xls,xlsx) so they are quarantined on my UTM. I've tried the >>> following which doesn't work. Can someone show me an exam

Re: Rule to score word documents

2016-03-30 Thread David B Funk
On Wed, 30 Mar 2016, Alex wrote: Hi, I'd like to assign a spamassassin score to received word documents (doc,docx,xls,xlsx) so they are quarantined on my UTM. I've tried the following which doesn't work. Can someone show me an example that should work? mimeheader DOC_ATTACHED Content-Type =~

Re: Rule to score word documents

2016-03-30 Thread @lbutlr
On Wed Mar 30 2016 13:34:23 Alex said: > > /^(Content-(Type|Disposition)\:|[[:space:]]+).*(file)?name="?.*\.doc"?;?$/ > REJECT /^\s*Content-(Disposition|Type).*name\s*=\s*"?(.*\.(ade|adp|bas|bat|chm|cmd|com|cpl|crt|dll|exe|hlp|hta|inf|ins|isp|js|jse|lnk|mdb|mde|mdt|mdw|msc|msi|msp|mst|nws

Re: Rule to score word documents

2016-03-30 Thread Reindl Harald
Am 30.03.2016 um 21:23 schrieb Rodney Green: I'd like to assign a spamassassin score to received word documents (doc,docx,xls,xlsx) so they are quarantined on my UTM. I've tried the following which doesn't work. Can someone show me an example that should work? 12.5 points for ordinary attachm

Re: Rule to score word documents

2016-03-30 Thread Alex
Hi, > I'd like to assign a spamassassin score to received word documents > (doc,docx,xls,xlsx) so they are quarantined on my UTM. I've tried the > following which doesn't work. Can someone show me an example that should > work? > > mimeheader DOC_ATTACHED Content-Type =~ /doc/i > describe DOC_ATTA

Rule to score word documents

2016-03-30 Thread Rodney Green
Hello, I'd like to assign a spamassassin score to received word documents (doc,docx,xls,xlsx) so they are quarantined on my UTM. I've tried the following which doesn't work. Can someone show me an example that should work? mimeheader DOC_ATTACHED Content-Type =~ /doc/i describe DOC_ATTACHED email