On Mon, 3 Nov 2014, Reindl Harald wrote:
in fact we can kill them all by a single rule and so extend it to future
filenames or foldernames
uri RH_URI_MLW_ZEROHOUR
/\/(dropbox|googlebox|banking)\/(document|doc|invoice)\.php$/
score RH_URI_MLW_ZEROHOUR 100
Adding a tuned version of this to my sandbox right now.
--
John Hardin KA7OHZ http://www.impsec.org/~jhardin/
jhar...@impsec.org FALaholic #11174 pgpk -a jhar...@impsec.org
key: 0xB8732E79 -- 2D8C 34F4 6411 F507 136C AF76 D822 E6E6 B873 2E79
-----------------------------------------------------------------------
...the good of having the government prohibited from doing harm
far outweighs the harm of having it obstructed from doing good.
-- Mike@mike-istan
-----------------------------------------------------------------------
8 days until Veterans Day
