Spam Assassin Rules

What's Working Now in Spam Assassin -- Some Simple SA Rules and Plug-ins

Ever do a Google search for Spam Assassin rules that detect attachments? I did, and didn't have a lot of luck. I believe the reason is that, although multi-part attachment designations appear in the body of the E-mail, Spam Assassin will not allow you to look at those designations using a simple rule. Even a rawbody rule will not allow you to examine content-type designations. So how do we look at attachments?

I found one way to detect attachments. Is it the right way? Probably not. Does it work? It appears to. I offer this up as alpha code for you to play with. PLEASE do a spamassassin --lint command to check things if you use this.

Obviously you need to use the later versions of SA (3-series) as the older versions did not support Plug-ins like this.

Some significant caveats for this:

1. As it stands, this only detects zip and pdf attachments. You can add others very easily by modifying the REGEX in the Plug-in.

2. Obviously there is TONS of ham mail that has pdf and zip attachments. That is why YOU NEED TO BE CAREFUL with the scores on this. I only activate it for my users who very seldom get these type of attachments. Even then I only use it as a rule to bump the total over the threshold when used in combination with other rules.

3. There may be (very easy) ways for spammers to hide attachments from this Plug-in. It works for the majority of them though. I can add some more hooks if necessary.

4. I would recommend you NOT add image type attachments to the list of file types. There are plenty of default tests for images, just adjust the scores accordingly.

There are two pieces to this. The Plug-in itself which is just a Perl module and the ruleset that activates it. I placed the Plug-in in the following sub-directory: .../Mail/SpamAssassin/Plugin/ This is the standard library directory. This is usually under one of your /usr/lib subdirectories. Doing locate Plugin will usually give you some clues where they are hiding. You can place the Plug-in in the same location as your .cf file (See next paragraph) but you must explicitly point to the Plug-in with something like loadplugin Mail::Attachments

The second piece is the activation rule. I place this in a standard .cf file under /etc/mail/spamassassin/ directory. That's the same place I put other rules below.

loadplugin      Mail::SpamAssassin::Plugin::Attachments

body    ATTACHMENT_PRESENT      eval:check_attach()
score   ATTACHMENT_PRESENT      0.1
describe        ATTACHMENT_PRESENT      Contains a pdf or zip attachment

You can download the Plug-in here: attachment-plugin.tar

Below are some rules which I use with Spam Assassin. I change these about once a week depending on what the spammers do and this page changes somewhat less frequently than that. Use these at your own risk. You need to assess the effects of these on your E-mail. Perhaps set the Score for a rule to 0.01 until you know how it works on your server.

You will notice rather high scores on many of these rules because I tend to only write rules that target spam slipping through the default rules in SA. That is, if SA was already tagging the "leaker" spam, I wouldn't need the new rule! So there is no point setting the scores on these to a low number (except when I test them initially for false positives). In for a penny, in for a pound. Go big or stay at home.

There is a strong temporal element to rule writing. When I first wrote my DICT_DUMP rule, dictionary dumping and Bayes poisoning was popular and I would get hundreds of hits a day on that. Now I hardly get one hit a day. [Note that the latest version of Spam Assassin now has a dictionary dump rule as part of it's default rule set -- I still use mine in conjunction with that.] Even the old-school tactic of subject obfuscation has fallen off significantly lately. Some of the rules only apply to one spammer and when they go away or change tactics, the rule lays idle. Nobody said this was a low maintenance game!

I DID NOT AUTHOR ALL OF THESE RULES! I am not attempting to take credit for someone else's work. You can find many of these rules and some other excellent rules at the Apache Custom Rulesets page. I've hacked some of these for my own uses as shown below.

Am I worried that the spammers will gain some intel from this? Not really. You think they actually spend time looking for this stuff? Even if they did, I'll just write more rules. It becomes a chicken-or-egg situation and always will be. I'm so far off the radar screen I have much bigger issues to worry about.

If you have any doubt about using blacklists with Spam Assassin, be sure to have a look at our page on the effectiveness of Spam Assassin and Blacklists. Ideally you would run the DNS blacklists on the SMTP server, not in Spam Assassin, but sometimes you get mail via forwarding or fetchmail and still need the blacklist portion of Spam Assassin.

After looking at some of this, I hope people will realize how easy it is to make custom rules. You can, at least temporarily, significantly increase the effectiveness of SA by spending 30 seconds authoring a custom rule. Nothing below is rocket science. Also look carefully at the hits the leaker spam is getting on the existing SA rules. Some times you can simply bump up a score value for an existing rule and push the leaker spam over the threshold. When the spam tactic de jour changes, you can remove the score bump.

Some general pointers for choosing a custom rule to catch the leakers. (again, not rocket science. And I do know about rocket science.)

I put these rules in a custom .cf file in the /etc/mail/spamassassin/ directory and restart the spamd daemon each time I change the file.

So all you need to do is cut and paste these into a file, say and save that file in /etc/mail/spamassassin/

Then, just restart the Spam Assassin daemon, spamd. (You are running spamd aren't you? If not, why not!?) On many versions of Linux you can do this with service spamassassin restart although you'll want to check your documentation to see how to restart spamd.

Rules....(and a few score bumps)

# Short-Circuit if found in local blacklist or whitelist

priority      SC_HAM -1000
shortcircuit  SC_HAM ham
score         SC_HAM -20

rawbody     NO_HTTP   /and paste in your browser/i
score       NO_HTTP   4.5
describe    NO_HTTP   No HTTP on link

body        STOCKDUMP2   /Investor Alert/i
score       STOCKDUMP2   7.0
describe    STOCKDUMP2   Pump and Dump Investor Alert

rawbody     GEOCITIES1   /\.geocities\.com\//i
score       GEOCITIES1   5.0
describe    GEOCITIES1   Geocities Link

rawbody     GEOCITIES2   /\.geocities\.yahoo\//i
score       GEOCITIES2   5.0
describe    GEOCITIES2   Geocities Link 2

body        SOFTWARESPAM   /attachment message\.html/
score       SOFTWARESPAM   5.0
describe    SOFTWARESPAM   leaker software scam

rawbody     TRIPOD1   /\.tripod\.com/
score       TRIPOD1   5.0
describe    TRIPOD1   Tripod Link

body        STOCKDUMP5   /investment advice/
score       STOCKDUMP5   4.9
describe    STOCKDUMP5   Pump and Dump Five

header      VIRUS_SPAM   Subject =~ /Hidden message/
score       VIRUS_SPAM   99.0
describe    VIRUS_SPAM   Potential virus in attachment

header      VIRUS_SPAM2   Subject =~ /Protected message/
score       VIRUS_SPAM2   99.0
describe    VIRUS_SPAM2   Potential virus in attachment 2

body        STOCKDUMP8   /\W[A-Z]{4}\s*\.\s*PK\s/i
score       STOCKDUMP8   4.5
describe    STOCKDUMP8   Pump and Dump Microcap One

body        STOCKDUMP9   /\W[A-Z]{4}\s*\.\s*OB\s/i
score       STOCKDUMP9   4.5
describe    STOCKDUMP9   Pump and Dump Microcap Two

header      BOGUS_THREAD   ALL =~ /Thread-Index/i
score       BOGUS_THREAD   0.5
describe    BOGUS_THREAD   Contains Thread-Index in header

body        STOCKDUMP13   /Target price/i
score       STOCKDUMP13   10.0
describe    STOCKDUMP13   Pump and Dump target price

rawbody     MALWARE01   /ecard number/i
score       MALWARE01   10.0
describe    MALWARE01   E-Card Malware Attempt

rawbody     NICEG   /I am nice girl/i
score       NICEG   6.5
describe    NICEG   Nice Girl mail order bride

body        DICT_DUMP_CUSTOM01   /(((\b|\s)[a-z]{4,}\b){7,})/
describe    DICT_DUMP_CUSTOM01   Text in non-English syntax-4X7
score       DICT_DUMP_CUSTOM01   0.5

body        DICT_DUMP_CUSTOM02   /(((\b|\s)[a-z]{5,}\b){7,})/
describe    DICT_DUMP_CUSTOM02   Text in non-English syntax-5X7
score       DICT_DUMP_CUSTOM02   0.8

body        DICT_DUMP_CUSTOM03   /(((\b|\s)[a-z]{5,}\b){8,})/
describe    DICT_DUMP_CUSTOM03   Text in non-English syntax-5X8
score       DICT_DUMP_CUSTOM03   1.2

header      RODENTDROPPINGS1   ALL =~ /SquirrelMail authenticated user/i
score       RODENTDROPPINGS1   0.1
describe    RODENTDROPPINGS1   Mail from a SquirrelMail account

body        SHYSTER_ONE   /barrister/i
score       SHYSTER_ONE   2.0
describe    SHYSTER_ONE   Body makes reference to barrister

uri         PAGE_AD   /pagead\/iclk/i
score       PAGE_AD   4.2
describe    PAGE_AD   Google relay to spamvertized site

uri         EXE_FILE   /\w\.exe/i
score       EXE_FILE   10.0
describe    EXE_FILE   Potential link to executable

uri         BLOGSPLAT   /\w\.blogspot\.com/i
score       BLOGSPLAT   2.5
describe    BLOGSPLAT   Contains link to

header      RODENTDROPPINGS2   ALL =~ /Internet Messaging Program \(IMP\)/
score       RODENTDROPPINGS2  0.1
describe    RODENTDROPPINGS2  Mail from an IMP agent


# Bump up some scores that should have low likelyhood of FP

score   RCVD_IN_SBL             5.5
score   RCVD_IN_XBL             5.5
score   RCVD_IN_PBL             5.5
score   RCVD_IN_DSBL            5.0
score   RCVD_IN_SORBS_HTTP      3.5
score   RCVD_IN_SORBS_MISC      3.5
score   RCVD_IN_SORBS_SMTP      4.5
score   RCVD_IN_SORBS_SOCKS     3.5
score   RCVD_IN_SORBS_WEB       3.5
score   RCVD_IN_SORBS_BLOCK     4.5
score   RCVD_IN_SORBS_ZOMBIE    3.5
score   RCVD_IN_SORBS_DUL       4.5
score   HTML_IMAGE_ONLY_04      4.0
score   HTML_MESSAGE            0.3
score   INVALID_DATE            3.2
score   RCVD_IN_NJABL_SPAM      3.5
score   RCVD_IN_NJABL_PROXY     5.5
score   RCVD_IN_NJABL_RELAY     4.5
score   RCVD_IN_NJABL_MULTI     2.5
score   RCVD_IN_NJABL_CGI       2.5
score   ONLINE_PHARMACY         4.0
score   URIBL_SBL               5.5
score   URIBL_SC_SURBL          5.5
score   URIBL_WS_SURBL          4.9
score   URIBL_PH_SURBL          4.9
score   URIBL_OB_SURBL          4.9
score   URIBL_AB_SURBL          4.9
score   URIBL_JP_SURBL          4.9
score   URIBL_BLACK             5.0
score   SPF_HELO_PASS           -1.0
score   SPF_PASS                -1.0
score   RCVD_ILLEGAL_IP         5.0
score   RATWARE_RCVD_PF         4.8
score   BAYES_99                4.8
score   RDNS_NONE               3.8
score   URIBL_RHS_DOB           3.8

# Do a summary to give more weight to blacklists

describe   CUSTOM_RCVD_IN_MANY   Message received in more than 2 RBLs
score      CUSTOM_RCVD_IN_MANY 3.0

# Do a check for odd letter combinations
# The following rules were borrowed from an older version of SA.
rawbody  __PGP_BEGIN            /^-----BEGIN PGP SIGNATURE-----$/
rawbody  __PGP_MIDDLE           /^[0-9A-Za-z+\/]{64}$/
rawbody  __PGP_END              /^-----END PGP SIGNATURE-----$/
meta     __PGP_SIGNATURE        (__PGP_BEGIN && __PGP_MIDDLE && __PGP_END)

# Prevent hits with Double forwards, or messages with attachments not parsed out.
rawbody  __FVGT_rb_ATTACHMENT   /Content-Disposition: attachment/i

# Core obfu rules, these are generated from multiple US dictionary files.
body  __FVGT_b_OBFU_J           /j[bcfgw]/i
body  __FVGT_b_OBFU_OTHER       /(vj|vk|xj|xk|yy|zf|zj)/i
body  __FVGT_b_OBFU_Q0          /[jkpqtvwz]q/i
body  __FVGT_b_OBFU_Q1          /q[afhjkmnsy]/i
body  __FVGT_b_OBFU_V           /[fgqw]v/i
body  __FVGT_b_OBFU_X           /[cgjkqsvz]x/i
body  __FVGT_b_OBFU_Z           /[fjkpqx]z/i

+ __FVGT_b_OBFU_Q1 + __FVGT_b_OBFU_V + __FVGT_b_OBFU_X + __FVGT_b_OBFU_Z) > 1)
+ __FVGT_b_OBFU_Q1 + __FVGT_b_OBFU_V + __FVGT_b_OBFU_X + __FVGT_b_OBFU_Z) > 2)
+ __FVGT_b_OBFU_Q1 + __FVGT_b_OBFU_V + __FVGT_b_OBFU_X + __FVGT_b_OBFU_Z) > 3)
+ __FVGT_b_OBFU_Q1 + __FVGT_b_OBFU_V + __FVGT_b_OBFU_X + __FVGT_b_OBFU_Z) > 4)

# Core meta rules, these combine multiple variations of above rules.
describe   FVGT_m_MULTI_ODD2   Contains multiple odd letter combinations
describe   FVGT_m_MULTI_ODD3   Contains multiple odd letter combinations
describe   FVGT_m_MULTI_ODD4   Contains multiple odd letter combinations
describe   FVGT_m_MULTI_ODD5   Contains multiple odd letter combinations

score  FVGT_m_MULTI_ODD2 1.1
score  FVGT_m_MULTI_ODD3 1.3
score  FVGT_m_MULTI_ODD4 1.3
score  FVGT_m_MULTI_ODD5 1.4

uri    FVGT_u_HAS_2LETTERFLDR    /\/[a-zA-Z]{2}\//
describe    FVGT_u_HAS_2LETTERFLDR    FVGT - URL has a 2 letter folder like /ab/
score    FVGT_u_HAS_2LETTERFLDR    0.5

header  FVGT_s_SINGLE_LETTER Subject =~ /\s[dfghjlmnpqstvwzDFGHJLMNPQSTVWZ]{1}\s/
describe FVGT_s_SINGLE_LETTER FVGT - Single non-vowel seperated by spaces

Copyright 2012

Vectors at

Acting on Annoyance