Just off the top of my head:
rawbody ONEDRIVE_DOWNLOAD m'https://onedrive\.live\.com/download[?]cid='
score ONEDRIVE_DOWNLOAD 0.5
describe ONEDRIVE_DOWNLOAD Download link to a file on Onedrive
Personally I'd be inclined to put an i on the end of that.
body FILE_PWD_INFO /\b(?:Fil lösenord|File
password):\s[A-Z]{2}\d{4}\b/
score FILE_PWD_INFO 3
describe FILE_PWD_INFO Email has a password to an archive file
meta PWD_ONEDRIVE_DLOAD ONEDRIVE_DOWNLOAD && FILE_PWD_INFO
score PWD_ONEDRIVE_DLOAD 4
describe PWD_ONEDRIVE_DLOAD Email contains download for passworded
Onedrive file
Loren
