On 2/7/2013 11:15 AM, Marc Perkel wrote:
How would you write a rule to detect a message with less than 5 lines and has a link in it?Are you by chance working on crap from compromised Yahoo! accounts? Have you looked at the 3.4 rule for __KAM_BODY_LENGTH_LT_128?
regards, kAM
