Where to get Filter descriptions

[ma...@sbgit.com]

Hi,

where can i get an good decription for the common
SA Filters like "SARE_SUB_SION_OB1" ??

Thanx Peter

Re: Where to get Filter descriptions

[Robert Menschel <Ro...@Menschel.net>]

Hello mailsec2,

Tuesday, May 31, 2005, 5:07:07 AM, you wrote:

msc> Hi,

msc> where can i get an good decription for the common
msc> SA Filters like "SARE_SUB_SION_OB1" ??

SARE_SUB_SION_OB1 can't be a common SA filter, since a) it claims to
be a SARE rule, b) I have a complete set of SARE rules, c) I'm the
maintainer of the 70_sare_genlsubj*.cf rules files in which SARE_SUB_*
should be found, and d) I don't have a copy of any rule with that
name.

The name implies OBfuscation in a SUBject header in the SION suffix of
a word, but since I don't have a copy of the rule, there's no way to
know for sure.

Which rules file did you find it in, and how old is that file?

Bob Menschel

Re: Where to get Filter descriptions

[Loren Wilton <lw...@earthlink.net>]

> >SA Filters like "SARE_SUB_SION_OB1" ??
>
> Well, that's not a common SA filter, it's a SARE add-on rule.
>
> In general that should be in one of the SARE gensubj*.cf rulesets, but I
> can't find it.

Without looking, I would guess the obfu ruleset, probably checking for
obfuscated forms of "sion" in the subject line.

        Loren

Re: Where to get Filter descriptions

[Matt Kettler <mk...@comcast.net>]

At 08:07 AM 5/31/2005, mailsec2@sbgit.com wrote:
>where can i get an good decription for the common
>SA Filters like "SARE_SUB_SION_OB1" ??

Well, that's not a common SA filter, it's a SARE add-on rule.

In general that should be in one of the SARE gensubj*.cf rulesets, but I 
can't find it.

try:

grep SARE_SUB_SION_OB1 /etc/mail/spamassassin/*.cf

and see if the describe line for the rule tells you anything useful. I'm 
guessing it's looking for a subject line containing a obfuscated spelling 
of the Scion brand of cars. My guess is that one had lots of FP's and was 
removed.