Hi,
I've fairly good results with this rule:
header __AJB_OBFU_PR0N_SUBJ Subject =~
/[\:\;\/\`\(\)\{\}~\#\&\"\%\$\_][a-z0-9][\:\;\`\(\)\/\{\}\_\~\#\&\"\%\$]/im
It's realy basic and desrve a rework.
Best,
Alex, from prypiat.
Yes, I recycle.
On 12-12-04 06:57 AM, Tom Hendrikx wrote:
> Hi,
>
> I'm currently seeing an increasing number of subjects like the ones
> below that are not being detected by SA. Looking through the existing
> rules (i'm still running v3.3.1) I'm seeing both the GAPPY_SUBJECT and
> the SERGIO_SUBJECT_VIAGRA01 approaches that are interested in this kind
> of stuff.
>
> I tried to adapt GAPPY_SUBJECT but it went over my head unfortunately,
> and ended up writing variants of SERGIO_SUBJECT_VIAGRA01 for several sex
> related strings. But being afraid to end up with (another ever
> expanding) list of phrases in rules: is there a better way to catch
> these? Maybe someone is able to refactor GAPPY_SUBJECT into something
> that hits on the example below too?
>
> Examples:
>
> Subject: S _C H0^0 &L (G. l ^RL S ( P0 |RN_
> Subject: H!AR -D C O !R &E`
> Subject: Un{d}r_es ,s -in {g
> Subject: P-0 :R |N . V I)D .E OS {
> Subject: P "O/R N= F "lLM
> Subject: B &AN +G l_N$G _
> Subject: G.r_ a|n.n|y P `o,r|n.
> Subject: S =E ^X/ V l D|EO (
> Subject: P{O{R N M;O}V^I(E _S !
> Subject: B l )G ;C O {C K. S !
> Subject: Ba }n .gl&n-g
> Subject: S ;c{h\o "o /l_ g ;i ,rl Por {n ^
>
> --
> Kind regards,
> Tom
signature.asc
Description: OpenPGP digital signature
