# /etc/spamassassin/70-ku-auto-distro-rules.cf
#
# ::do_not_edit::
# ::copy::
# ::maintainer::
#
# SpamAssassin KLAB distro rules, automatically installed by "kusa"
#
# BLACKLIST rules

header		KU_BL_DS_001_0	Subject =~ /ch*rono[mg]/i
score		KU_BL_DS_001_0	3.0
describe	KU_BL_DS_001_0	(kusa-distro) spam.chrono.001

header		KU_BL_DS_001_1	From =~ /ch*rono[mg]/i
score		KU_BL_DS_001_1	3.0
describe	KU_BL_DS_001_1	(kusa-distro) spam.chrono.001

header		KU_BL_DS_002_0	Subject =~ /orologi/i
score		KU_BL_DS_002_0	3.0
describe	KU_BL_DS_002_0	(kusa-distro) spam.chrono.002

header		KU_BL_DS_002_1	From =~ /orologi/i
score		KU_BL_DS_002_1	3.0
describe	KU_BL_DS_002_1	(kusa-distro) spam.chrono.002

header		KU_BL_DS_003_0	Subject =~ /ciali[sz]/i
score		KU_BL_DS_003_0	3.5
describe	KU_BL_DS_003_0	(kusa-distro) spam.drugs.cialis

header		KU_BL_DS_003_1	From =~ /ciali[sz]/i
score		KU_BL_DS_003_1	3.5
describe	KU_BL_DS_003_1	(kusa-distro) spam.drugs.cialis

header		KU_BL_DS_004_0	Subject =~ /f[ra][ra]maci/i
score		KU_BL_DS_004_0	3.5
describe	KU_BL_DS_004_0	(kusa-distro) spam.drugs.farmacia

header		KU_BL_DS_004_1	From =~ /f[ra][ra]maci/i
score		KU_BL_DS_004_1	3.5
describe	KU_BL_DS_004_1	(kusa-distro) spam.drugs.farmacia

header		KU_BL_DS_005_0	Subject =~ /drugs*/i
score		KU_BL_DS_005_0	3.5
describe	KU_BL_DS_005_0	(kusa-distro) spam.drugs.generic

header		KU_BL_DS_005_1	From =~ /drugs*/i
score		KU_BL_DS_005_1	3.5
describe	KU_BL_DS_005_1	(kusa-distro) spam.drugs.generic

header		KU_BL_DS_006_0	Subject =~ /medicin/i
score		KU_BL_DS_006_0	3.5
describe	KU_BL_DS_006_0	(kusa-distro) spam.drugs.med

header		KU_BL_DS_006_1	From =~ /medicin/i
score		KU_BL_DS_006_1	3.5
describe	KU_BL_DS_006_1	(kusa-distro) spam.drugs.med

header		KU_BL_DS_007_0	Subject =~ /pillol/i
score		KU_BL_DS_007_0	3.5
describe	KU_BL_DS_007_0	(kusa-distro) spam.drugs.pillole

header		KU_BL_DS_007_1	From =~ /pillol/i
score		KU_BL_DS_007_1	3.5
describe	KU_BL_DS_007_1	(kusa-distro) spam.drugs.pillole

header		KU_BL_DS_008_0	Subject =~ /piloll/i
score		KU_BL_DS_008_0	3.5
describe	KU_BL_DS_008_0	(kusa-distro) spam.drugs.pillole2

header		KU_BL_DS_008_1	From =~ /piloll/i
score		KU_BL_DS_008_1	3.5
describe	KU_BL_DS_008_1	(kusa-distro) spam.drugs.pillole2

header		KU_BL_DS_009_0	Subject =~ /pills/i
score		KU_BL_DS_009_0	3.5
describe	KU_BL_DS_009_0	(kusa-distro) spam.drugs.pills

header		KU_BL_DS_009_1	From =~ /pills/i
score		KU_BL_DS_009_1	3.5
describe	KU_BL_DS_009_1	(kusa-distro) spam.drugs.pills

# attachments

ifplugin Mail\::SpamAssassin\::Plugin\::MIMEHeader

  mimeheader	__KU_BL_DS_EXE1		Content-Disposition =~ /filename=\"?.*\.(?:exe|vbs|com|pif|cmd|bat|cpl|scr|js)\"?\s*;*$/i
  mimeheader	__KU_BL_DS_EXE2		Content-Type =~ /filename=\"?.*\.(?:exe|vbs|com|pif|cmd|bat|cpl|scr|js)\"?\s*;*$/i
  meta		KU_BL_DS_EXE		__KU_BL_DS_EXE1 || __KU_BL_DS_EXE2
  score   	KU_BL_DS_EXE		10.00
  describe	KU_BL_DS_EXE		(kusa-distro) executable attachments, rejected

  mimeheader 	__KU_BL_DS_MSDOC1	Content-Disposition =~ /filename=\"?.*\.(?:doc|docx|docm|xls|xlsx|xlsm|xlm|rtf)\"?\s*;*$/i
  mimeheader 	__KU_BL_DS_MSDOC2	Content-Type =~ /filename=\"?.*\.(?:doc|docx|docm|xls|xlsx|xlsm|xlm|rtf)\"?\s*;*$/i
  meta		KU_BL_DS_MSDOC		__KU_BL_DS_MSDOC1 || __KU_BL_DS_MSDOC2
  score   	KU_BL_DS_MSDOC		4.0
  describe	KU_BL_DS_MSDOC		(kusa-distro) MSoffice attachments, probabile macros attack

  mimeheader 	__KU_BL_DS_ZIP1		Content-Disposition =~ /filename=\"?.*\.(?:zip|7zip|7z)\"?\s*;*$/i
  mimeheader 	__KU_BL_DS_ZIP2		Content-Type =~ /filename=\"?.*\.(?:zip|7zip|7z)\"?\s*;*$/i
  meta		KU_BL_DS_ZIP		__KU_BL_DS_ZIP1 || __KU_BL_DS_ZIP2
  score   	KU_BL_DS_ZIP		2.0
  describe	KU_BL_DS_ZIP		(kusa-distro) zipped attachment, possible attack

  mimeheader 	__KU_BL_DS_ARJ1		Content-Disposition =~ /filename=\"?.*\.(?:lha|arj|ace)\"?\s*;*$/i
  mimeheader 	__KU_BL_DS_ARJ2		Content-Type =~ /filename=\"?.*\.(?:lha|arj|ace)\"?\s*;*$/i
  meta		KU_BL_DS_ARJ		__KU_BL_DS_ARJ1 || __KU_BL_DS_ARJ2
  score   	KU_BL_DS_ARJ		4.0
  describe	KU_BL_DS_ARJ		(kusa-distro) obsolete compressed attachment, probabile scam

  mimeheader	__KU_BL_DS_ISO1		Content-Disposition =~ /filename=\"?.*\.(?:iso)\"?\s*;*$/i
  mimeheader	__KU_BL_DS_ISO2		Content-Type =~ /filename=\"?.*\.(?:iso)\"?\s*;*$/i
  meta		KU_BL_DS_ISO		__KU_BL_DS_ISO1 || __KU_BL_DS_ISO2
  score   	KU_BL_DS_ISO		10.00
  describe	KU_BL_DS_ISO		(kusa-distro) iso-image attachments, rejected

endif
