I wanted to create rule for empty email body but did not get any appropriate information. Finally, after lots of testing ,I have sorted out it and these are the rules if anyone else also need them: (You can use PDFInfo plugin but it checks for empty email body with a pdf attachment)
*Empty email body :* rawbody EMPTY_MAIL_BODY /^(\<br\>)+\s*$/ *Empty email body and empty subject :* header EMPTY_SUBJECT Subject=~/^(\s)*$/ meta EMPTY_MAIL EMPTY_MAIL_BODY && EMPTY_SUBJECT describe EMPTY_MAIL Empty mail body and empty subject score EMPTY_MAIL 1.5 *Empty email body with attachment :* * * mimeheader __ATTACHMENT Content-Type =~ /multipart\/mixed/i meta EMPTY_MAIL_ATTACH EMPTY_MAIL_BODY && __ATTACHMENT describe EMPTY_MAIL_ATTACH Empty mail body with attachment score EMPTY_MAIL_ATTACH 1.5 Any suggestions are always welcome. Regards, Swati R
