OwlCyberSecurity - MANAGER

Edit File: 73_sandbox_manual_scores.cf

# SpamAssassin rules file # # Manual override of the automatically-generated scores # for automatically-published sandbox rules # # <@LICENSE> # Licensed to the Apache Software Foundation (ASF) under one or more # contributor license agreements. See the NOTICE file distributed with # this work for additional information regarding copyright ownership. # The ASF licenses this file to you under the Apache License, Version 2.0 # (the "License"); you may not use this file except in compliance with # the License. You may obtain a copy of the License at: # # http://www.apache.org/licenses/LICENSE-2.0 # # Unless required by applicable law or agreed to in writing, software # distributed under the License is distributed on an "AS IS" BASIS, # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and # limitations under the License. # </@LICENSE> # ########################################################################### require_version 3.004006 # jhardin # things depend on these # score as informative just for the hits header score LOTS_OF_MONEY 0.001 score FILL_THIS_FORM 0.001 # jhardin # reevolved Advance Fee rules # scores are cumulative (i.e. 3 hits 2, 4 hits 3 and 2) # Commented out if GA is scoring reasonably #score ADVANCE_FEE_2_NEW_MONEY 0.50 #score ADVANCE_FEE_2_NEW_FORM 0.75 #score ADVANCE_FEE_3_NEW 0.50 #score ADVANCE_FEE_3_NEW_MONEY 1.00 #score ADVANCE_FEE_3_NEW_FORM 1.00 #score ADVANCE_FEE_4_NEW 1.00 #score ADVANCE_FEE_5_NEW 1.50 score ADVANCE_FEE_5_NEW_MONEY 3.00 # jhardin # metas using Advance Fee component rules # Commented out if GA is scoring reasonably #score FORM_FRAUD_3 0.50 #score FORM_FRAUD_5 0.50 #score MONEY_FRAUD_3 1.00 #score MONEY_FRAUD_5 0.50 #score MONEY_FRAUD_8 0.50 # jhardin # GA scores this unreasonably high, and # the fact that this is defined in an #ifplugin # appears to be preventing score limiting from working score FILL_THIS_FORM_LONG 2.00 # jhardin # misc rules # Commented out if GA is scoring reasonably #score FROM_MISSP_MSFT 0.50 #score TO_NO_BRKTS_DYNIP 0.50 #score LOTTO_AGENT 0.50 # jhardin # 1.000 S/O, hits only <= 6 points, but GA is not publishing it! # perhaps because very few examples in spam corpus # 12/24/12 GA likes it now #score GOOGLE_DOCS_PHISH 3.00 # similar: .990 S/O, hits primarily spam <= 5 points # 01/07/13 GA likes it now #score EMAIL_URI_PHISH 2.50 # Reliable but not widespread (low corpus count, ahead of the curve?), boost the score score PHISH_AZURE_CLOUDAPP 3.50 score URI_GOOG_STO_SPAMMY 3.50 # jhardin # double-extension file attachments, low corpus count score PHISH_ATTACH 3.50 score MALW_ATTACH 3.50 # hege # FPs reported [bug 6417], GA assigning 3+ points # reduce score until that's resolved # score HK_FAKENAME_MICROSOFT 2.50 # RULE DISABLED IN 20_hk.cf # jhardin for mmartinec # Lots of hate; score as informative hammy, may override locally score RP_MATCHES_RCVD -0.001 # until rule or rescoring issues sorted, hits 20%+ ham # too problematic, disabled entirely #score STYLE_GIBBERISH 0.1 # jhardin # Limit some network scores until rule changes can be evaluated by weekly net masscheck # Dangit, relative scores are broken - see bug#7721 #score FROM_IN_TO_AND_SUBJ (0) 0.001 (0) 0.001 #score OBFU_TEXT_ATTACH (0) 0.001 (0) 0.001 #score MIME_NO_TEXT (0) 0.001 (0) 0.001 #score AD_PREFS (0) 0.001 (0) 0.001 score AD_PREFS 0.250 #score URI_WP_HACKED_2 (0) 0.001 (0) 0.001 #score STYLE_GIBBERISH (0) 0.001 (0) 0.001 #score UC_GIBBERISH_OBFU (0) 0.001 (0) 0.001 #score LUCRATIVE (0) 0.001 (0) 0.001 #score HEXHASH_WORD (0) 0.001 (0) 0.001 #score FROM_WORDY (0) 0.001 (0) 0.001 #score AC_HTML_NONSENSE_TAGS (0) 0.001 (0) 0.001 #score LONG_HEX_URI (0) 0.001 (0) 0.001 #score FROM_PAYPAL_SPOOF (0) 0.001 (0) 0.001 # jhardin # Don't joe-job a SA dev's wife score ADULT_DATING_COMPANY 20.000