RE: New Obfuscation Technique?

[Bret Miller <br...@wcg.org>]

> The SARE rules seem to catch that kind of thing rather neatly. In
> particular these are caught by some of the anti-Leo rules that Loren
> wrote.
> {^_^}


I run most of the production SARE rulesets here-- which would those be
in? Or are those some adhoc rules posted to the list that I didn't pick
up on? Just looking at where I might find the rules...

Bret


> ----- Original Message ----- 
> From: "Bret Miller" <br...@wcg.org>
> 
> 
> I hadn't seen this type of obfuscation before, though I admit I don't
> watch the dropped spam very closely. This one got returned to 
> me via my
> AOL feedback loop, so was looking to see how to catch it. Any 
> ideas? Get
> a sample message here:
> 
> http://webmail.wcg.org/~support/16-02-01-P.txt 
> 
> Thanks,
> Bret
> 
> 
> 

Re: New Obfuscation Technique?

[Dan <a...@patnode.net>]

> I run most of the production SARE rulesets here-- which would those be
> in? Or are those some adhoc rules posted to the list that I didn't  
> pick
> up on? Just looking at where I might find the rules...

You're welcome to use mine (newly improved).  All of these catch on  
your sample:


body OBSFU_VIA1 /(?!VIAGRA)\bV(\s|\s\s|\s\S|\s\S\s|\S\s|\S)?[I1\/\\] 
(\s|\s\s|\s\S|\s\S\s|\S\s|\S)?A(\s|\s\s|\s\S|\s\S\s|\S\s|\S)?G(\s|\s 
\s|\s\S|\s\S\s|\S\s|\S)?R(\s|\s\s|\s\S|\s\S\s|\S\s|\S)?A\b/i

body OBSFU_CIA1 /(?!CIALIS)\bC(\s|\s\s|\s\S|\s\S\s|\S\s|\S)?[I1\/\\] 
(\s|\s\s|\s\S|\s\S\s|\S\s|\S)?A(\s|\s\s|\s\S|\s\S\s|\S\s|\S)?L(\s|\s 
\s|\s\S|\s\S\s|\S\s|\S)?[I1\/\\](\s|\s\s|\s\S|\s\S\s|\S\s|\S)?S\b/i

body OBSFU_VAL1 /(?!VALIUM)\bV(\s|\s\s|\s\S|\s\S\s|\S\s|\S)?A(\s|\s\s| 
\s\S|\s\S\s|\S\s|\S)?L(\s|\s\s|\s\S|\s\S\s|\S\s|\S)?[I1\/\\](\s|\s\s| 
\s\S|\s\S\s|\S\s|\S)?U(\s|\s\s|\s\S|\s\S\s|\S\s|\S)?M\b/i

body OBSFU_AMB1 /(?!AMBIEN)\bA(\s|\s\s|\s\S|\s\S\s|\S\s|\S)?M(\s|\s\s| 
\s\S|\s\S\s|\S\s|\S)?B(\s|\s\s|\s\S|\s\S\s|\S\s|\S)?[I1\/\\](\s|\s\s| 
\s\S|\s\S\s|\S\s|\S)?E(\s|\s\s|\s\S|\s\S\s|\S\s|\S)?N\b/i

body OBSFU_XAN1 /(?!XANAX)\bX(\s|\s\s|\s\S|\s\S\s|\S\s|\S)?A(\s|\s\s| 
\s\S|\s\S\s|\S\s|\S)?N(\s|\s\s|\s\S|\s\S\s|\S\s|\S)?A(\s|\s\s|\s\S|\s 
\S\s|\S\s|\S)?X\b/i


Dan