I do it fully separately from spamassassin. I have a list of patterns in a file that are matched by saying m/\b$pattern\b/. (\b means word boundary). If I get more than one or two spams advertising a particular stock, I put that stock name in the pattern list.
All messages mentioning those spammed stocks (or websites, or any other keyword) end up in my special "blocked" spambucket. (and that's where your post ended up also). I review it once a few days. It's worked for me for years and is supplementing spamassassin nicely. These stock spammers are very obnoxious and send very numerous instances of same spam to each recipient. i
