Per Jessen wrote: > What I meant to ask is - has anyone written rules for detecting > uuencoded files in the body text (not as attachment) ?
I have been going through my logs, and this problem is popping up a little more often than I'm comfortable with. OBSCURED_EMAIL is triggered quite frequently off such an embedded uuencoded document (seems to be predominantly Microsoft Word :-) I was thinking of using a rawbody rule, till I realised that it is applied line-by-line. Is there a way of writing a rule with a multi-line regex/pattern? /Per Jessen, Zürich
