Re: a simple rule for detecting Microsoft executables

[Theo Van Dinter]

On Sun, Nov 07, 2004 at 01:45:51AM +0100, Francesco Potorti` wrote:
> full     __h_exename_q          
> /\bname=("?).+?\.(?:bas|bat|cmd|com|cpl|exe|js|jse|msi|mst|pcd|pif|reg|scr|sct|vb|vbe|vbs|wsc|wsf|wsh|xsl)\1[[:blank:]]*(?:;|$)/mi
> rawbody  __b_exename_q          
> /\bname=("?).+?\.(?:bas|bat|cmd|com|cpl|exe|js|jse|msi|mst|pcd|pif|reg|scr|sct|vb|vbe|vbs|wsc|wsf|wsh|xsl)\1[[:blank:]]*(?:;|$)/mi

ewww!  $name="foo.com";

congrats, you just FPed. :)

If you're using 3.0, and you really feel a need to have a MICROSOFT_EXECUTABLE
rule, please see:

http://svn.apache.org/repos/asf/spamassassin/trunk/lib/Mail/SpamAssassin/Plugin/MSExec.pm
and
http://svn.apache.org/repos/asf/spamassassin/trunk/rules/25_msexec.cf

-- 
Randomly Generated Tagline:
Randal can write one-liners again.  Everyone is happy, and peace spreads
 over the whole Earth.
              -- Larry Wall in <[EMAIL PROTECTED]>

pgpOvLBGRL3Ry.pgp
Description: PGP signature