Can someone point me to a sa developer? We've been doing some hacking
on SA at work (guardiandigital.com) and have a rule that we'd like to
get run against the corpus. It's not worth getting all set up as real
submitters, so maybe someone could just toss it in with their next
run..? The suspicion is that this might help against the current flood
of image spam. Eric noticed that most of it seems to be sent as
multipart related instead of the common way, but we're a little
concerned about false positives.
Thanks!
Mike-
header LOCAL_MULTIPART_RELATED Content-Type =~ /multipart\/related;/
score LOCAL_MULTIPART_RELATED 0.753
describe LOCAL_MULTIPART_RELATED Stock messages with images attachments