You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by jh...@apache.org on 2021/01/27 03:40:12 UTC
svn commit: r1885929 -
/spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf
Author: jhardin
Date: Wed Jan 27 03:40:11 2021
New Revision: 1885929
URL: http://svn.apache.org/viewvc?rev=1885929&view=rev
Log:
Rule tweaks
Modified:
spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf
Modified: spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf?rev=1885929&r1=1885928&r2=1885929&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/jhardin/20_misc_testing.cf Wed Jan 27 03:40:11 2021
@@ -133,8 +133,8 @@ ifplugin Mail::SpamAssassin::Plugin::MIM
describe ISO_ATTACH ISO attachment - possible malware delivery
score ISO_ATTACH 3.000 # limit
- mimeheader __PHISH_ATTACH_01_01 Content-Disposition =~ /\bfilename="?[^"]*(?:\.pdf)\.(?:html)[";$]/i
- mimeheader __PHISH_ATTACH_01_02 Content-Type =~ /\bname="?[^"]*(?:\.pdf)\.(?:html)[";$]/i
+ mimeheader __PHISH_ATTACH_01_01 Content-Disposition =~ /\bfilename="?[^"]*(?:\.pdf)\.(?:html?)[";$]/i
+ mimeheader __PHISH_ATTACH_01_02 Content-Type =~ /\bname="?[^"]*(?:\.pdf)\.(?:html?)[";$]/i
meta PHISH_ATTACH __PHISH_ATTACH_01_01 || __PHISH_ATTACH_01_02
describe PHISH_ATTACH Attachment filename suspicious, probable phishing
tflags PHISH_ATTACH publish