> I'm using your rule here with a low score and in addition: > > rawbody INLINE_IMAGE2 /src\s*=\s*["']cid:image001\.gif/i > describe INLINE_IMAGE2 Inline Image image001.gif > score INLINE_IMAGE2 5.0 > > I know, I should have used a meta rule intead of duplicating the > pattern. > > Will work wonders till they change the filename.
It's already happened. I just received some image spams each with the different attachment names: name="masterpiece.gif" name="righteously.gif" name="locket.gif"
