rawbody LR_IMAGE_TAGGED_ASP =~ /\img width\=1 height\=1
src\=.*\.asp.*/i
There are a couple of things to consider here. The first is that rawbody
only gives the rule a single physical line of the message, so if the target
you are looking for spans lines the rule will never hit. If your target
I'm working up a rule (for 2.64) to try to increase the score of HTML
messages that contain a 1x1 pixel image which references an ASP script.
I've come up with this:
rawbody LR_IMAGE_TAGGED_ASP =~ /\img width\=1 height\=1
src\=.*\.asp.*/i
description LR_IMAGE_TAGGED_ASP Images with sources
