diff options
| -rw-r--r-- | conf/composites.conf | 8 | ||||
| -rw-r--r-- | rules/regexp/headers.lua | 23 |
2 files changed, 28 insertions, 3 deletions
diff --git a/conf/composites.conf b/conf/composites.conf index 00f46f966..a1f18749c 100644 --- a/conf/composites.conf +++ b/conf/composites.conf @@ -65,6 +65,14 @@ composites { expression = "-R_DKIM_ALLOW & (R_DKIM_TEMPFAIL | R_DKIM_PERMFAIL | R_DKIM_REJECT)" policy = "remove_weight"; } + APPLE_MAILER_COMMON { + description = "Message was sent by 'Apple Mail' and has common symbols in place"; + expression = "APPLE_MAILER & MV_CASE"; + } + APPLE_IOS_MAILER_COMMON { + description = "Message was sent by 'Apple iOS Mail' and has common symbols in place"; + expression = "APPLE_IOS_MAILER & (MV_CASE | MIME_MA_MISSING_TEXT)"; + } HACKED_WP_PHISHING { expression = "(HAS_X_POS | HAS_PHPMAILER_SIG) & HAS_WP_URI & (PHISHING | CRACKED_SURBL | PH_SURBL_MULTI | DBL_PHISH | DBL_ABUSE_PHISH | URIBL_BLACK | PHISHED_OPENPHISH | PHISHED_PHISHTANK)"; description = "Phish message sent by hacked Wordpress instance"; diff --git a/rules/regexp/headers.lua b/rules/regexp/headers.lua index 4a14fafc1..85d6cfcfd 100644 --- a/rules/regexp/headers.lua +++ b/rules/regexp/headers.lua @@ -963,6 +963,26 @@ reconf['OLD_X_MAILER'] = { group = 'headers', } +-- Detect Apple Mail +local apple_x_mailer = [[Apple Mail \(((Version )?[1-9]\.[0-9]*|[0-9]*\.[0-9]*\.[0-9]*\.[0-9]*)\)]] +reconf['APPLE_MAILER'] = { + description = 'Sent with Apple Mail', + re = string.format('X-Mailer=/^%s/{header}', apple_x_mailer), + score = 0.0, + group = 'headers', +} + +-- Detect Apple iPhone/iPad Mail +-- Apple iPhone/iPad Mail X-Mailer contains iOS build number, e. g. 9B206, 16H5, 18G5023c +-- https://en.wikipedia.org/wiki/IOS_version_history +local apple_ios_x_mailer = [[i(?:Phone|Pad) Mail \(\d{1,2}[A-Z]\d{1,4}[a-z]?\)]] +reconf['APPLE_IOS_MAILER'] = { + description = 'Sent with Apple iPhone/iPad Mail', + re = string.format('X-Mailer=/^%s/{header}', apple_ios_x_mailer), + score = 0.0, + group = 'headers', +} + -- X-Mailer header values which should not occur (in the modern mail) at all local bad_x_mailers = { -- header name repeated in the header value @@ -978,9 +998,6 @@ local bad_x_mailers = { -- but starts with 'iPhone Mail' or 'iPad Mail' is likely fake [[i(?:Phone|Pad) Mail]], } --- Apple iPhone/iPad Mail X-Mailer contains iOS build number, e. g. 9B206, 16H5, 18G5023c --- https://en.wikipedia.org/wiki/IOS_version_history -local apple_ios_x_mailer = [[i(?:Phone|Pad) Mail \((?:1[AC]|[34][AB]|5[ABCFGH]|7[A-E]|8[ABCEFGHJKL]|9[AB]|\d{2}[A-Z])\d+[a-z]?\)]] reconf['FORGED_X_MAILER'] = { description = 'Forged X-Mailer header', |