Re: postcard exploit email

[David B Funk]

On Mon, 11 Sep 2006, John D. Hardin wrote:

>
> Maybe we need a base rule for URL links directly to executable
> content...
>
> <a 
> href="http://www.canaltv.org/postcard.gif.exe";>http://www.e-cards.com/view/CR3090Ztyw5g527673XzW</a>

You mean like:

 uri __L_AUNT_EDNA1      m!\b(?:postcards?\.gif\.exe|/postcard\.exe)!i
 full __L_AUNT_EDNA2     m!\bpostcards?\.gif\.exe"!i
 meta L_AUNT_EDNA        ( __L_AUNT_EDNA1 || __L_AUNT_EDNA2 )
 describe L_AUNT_EDNA    Aunt Edna postcard virus spam
 score L_AUNT_EDNA       9.0

Specific to the "Aunt Edna" viri but generalizable. Warning, it
could have FPs.


-- 
Dave Funk                                  University of Iowa
<dbfunk (at) engineering.uiowa.edu>        College of Engineering
319/335-5751   FAX: 319/384-0549           1256 Seamans Center
Sys_admin/Postmaster/cell_admin            Iowa City, IA 52242-1527
#include <std_disclaimer.h>
Better is not better, 'standard' is better. B{