TORA.08 rule
Is safe to use this?? Seems to work...
body ASCIISPAM /([0123456789] ){5}/i
describe ASCIISPAM ASCII SPAM
score ASCIISPAM 1.0
Re: TORA.08 rule
Rejaine Monteiro wrote:
Is safe to use this?? Seems to work...
body ASCIISPAM /([0123456789] ){5}/i
describe ASCIISPAM ASCII SPAM
score ASCIISPAM 1.0
Depends.. do you ever get ascii-text numeric reports emailed to you?
Mind you, SA will condense whitespace to a single space, so
tab-delimited lists, even lists with a single number on a line, will
match this.
Things like:
5
4
3
2
1
blastoff!
Should match.
As would:
2 3 4
1 8 2
Re: TORA.08 rule
From: Matt Kettler [EMAIL PROTECTED]
Rejaine Monteiro wrote:
Is safe to use this?? Seems to work...
body ASCIISPAM /([0123456789] ){5}/i
describe ASCIISPAM ASCII SPAM
score ASCIISPAM 1.0
Depends.. do you ever get ascii-text numeric reports emailed to you?
Mind you, SA will condense whitespace to a single space, so
tab-delimited lists, even lists with a single number on a line, will
match this.
Things like:
5
4
3
2
1
blastoff!
Should match.
As would:
2 3 4
1 8 2
Take that above rule and build one that looks for more than three sets
of five digits and more than 10 sets of 1, 2, or 3 of digit numbers.
Catch the crossbars plus the legs. Then look for a paucity of alphabetic
characters. (Not absence, mind you.)
{^_^}
Re: TORA.08 rule
On Fri, Nov 17, 2006 at 08:15:21PM -0500, Matt Kettler wrote: 5 4 3 2 1 blastoff! Should match. You shouldn't be launching rockets via email. -- Randomly Selected Tagline: The only thing this show had in common with 'Cirque' is the fact that I had no idea what was going on. - Theo, regarding a Cirque-like theatre performance pgpyOZ9IRpCAt.pgp Description: PGP signature
Re: TORA.08 rule
Theo Van Dinter wrote: On Fri, Nov 17, 2006 at 08:15:21PM -0500, Matt Kettler wrote: 5 4 3 2 1 blastoff! Should match. You shouldn't be launching rockets via email. Hey, I don't know about your network, but I have mission control critical email :)
