> I'm using your rule here with a low score and in addition: > > rawbody INLINE_IMAGE2 /src\s*=\s*["']cid:image001\.gif/i > describe INLINE_IMAGE2 Inline Image image001.gif > score INLINE_IMAGE2 5.0 > > I know, I should have used a meta rule intead of duplicating the > pattern.
How about a meta with a rule that excludes commonly-generated Outlook inline image names? Bret
