--On November 3, 2014 at 7:52:10 AM -0800 John Hardin <jhar...@impsec.org>
wrote:
On Mon, 3 Nov 2014, Reindl Harald wrote:
in fact we can kill them all by a single rule and so extend it to future
filenames or foldernames
uri RH_URI_MLW_ZEROHOUR
/\/(dropbox|googlebox|banking)\/(document|doc|invoice)\.php$/
score RH_URI_MLW_ZEROHOUR 100
Adding a tuned version of this to my sandbox right now.
Care to share the tuned version?
--Quanah
--
Quanah Gibson-Mount
Platform Architect
Zimbra, Inc
--------------------
Zimbra :: the leader in open source messaging and collaboration
