aboutsummaryrefslogtreecommitdiffstats
path: root/rules
Commit message (Collapse)AuthorAgeFilesLines
* [Minor] Fix descriptionAndrew Lewis2024-07-081-1/+1
|
* [Rules] Added rules for detecting likely malwareAndrew Lewis2024-05-272-0/+157
|
* correct headers.luaishisora2024-05-211-1/+1
|
* [Minor] Exclude User-Agent: Mozilla Thunderbird from XM_UA_NO_VERSIONgami2024-05-141-1/+1
|
* [Minor] Exclude User-Agent: Mozilla Thunderbird from XM_UA_NO_VERSIONgami2024-05-141-2/+3
|
* [Minor] Constrain Content-Description regexptwesterhever2024-05-011-1/+1
|
* [Minor] Remove superflous "string.format()"twesterhever2024-05-011-1/+1
|
* [Enhancement] Catch "Mail message body" Content-Descriptiontwesterhever2024-04-281-0/+7
| | | | This header frequently surfaces in spam, mostly advance fee fraud.
* [Minor] Add rule for presence of Content-Description headertwesterhever2024-04-281-0/+7
|
* Fix error in headers_checks.luaDmitriy Alekseev2024-04-191-1/+1
|
* Merge pull request #4890 from twesterhever/temp-received-localhostVsevolod Stakhov2024-03-261-0/+7
|\ | | | | [Minor] Add rule for localhost HELOs in Received headers
| * [Minor] Add rule for localhost HELOs in Received headerstwesterhever2024-03-241-0/+7
| |
* | [Enhancement] Add more symbols for Reply-To header characteristicstwesterhever2024-03-241-14/+36
|/
* [Minor] Add HAS_FILE_URL rule for messages containing a file:// URLtwesterhever2024-02-291-0/+7
| | | | | | | | | These are frequently abused for distributing malware via non-HTTP protocols, such as public Samba servers. file:// URLs may also be abused for including files from the victims' machine in a message. Either way, a legitimate usecase is unlikely. Signed-off-by: twesterhever <40121680+twesterhever@users.noreply.github.com>
* [Minor] Add rule for messages missing both X-Mailer and User-Agent headertwesterhever2023-11-031-0/+10
|
* [Rules] Blank spam detectionAndrew Lewis2023-10-134-4/+37
|
* [Fix] MISSING_MIMEOLE: avoid matching messages from Android GMail app (#4561)Andrew Lewis2023-09-141-2/+4
|
* [Minor] Reformat all Lua code, no functional changesVsevolod Stakhov2023-08-0719-367/+520
|
* [Minor] Tweak HAS_GOOGLE_REDIR to detect Google AMP URLs as welltwesterhever2023-08-021-1/+1
| | | | Rationale: https://cofense.com/blog/google-amp-the-newest-of-evasive-phishing-tactic/
* Adjust apple_x_mailer regexDmitriy Alekseev2023-07-121-1/+1
|
* [Minor] A bit better apple_x_mailer regexDmitriy Alekseev2023-07-121-1/+1
|
* Optimize apple_ios_x_mailer regexDmitriy Alekseev2023-07-121-1/+1
|
* Support regex rules to detect Apple MailDmitriy Alekseev2023-07-111-3/+20
|
* Merge pull request #4497 from twesterhever/temp-improve-has-google-redirVsevolod Stakhov2023-06-221-2/+2
|\ | | | | [Enhancement] Improve detection of Google redirection URLs
| * [Minor] Remove superfluous '|' in regular expressiontwesterhever2023-06-221-1/+1
| |
| * [Minor] Simplify regular expression for HAS_GOOGLE_REDIRtwesterhever2023-06-221-1/+1
| | | | | | | | https://github.com/rspamd/rspamd/pull/4497#issuecomment-1586265815
| * [Enhancement] Improve detection of Google redirection URLstwesterhever2023-05-261-2/+2
| | | | | | | | | | The list is derived from Firefox' static HPKP entires, retrieved from: https://searchfox.org/mozilla-central/source/security/manager/ssl/StaticHPKPins.h
* | Merge pull request #4494 from twesterhever/temp-arm-google-firebaseVsevolod Stakhov2023-06-111-2/+2
|\ \ | | | | | | [Rules] Make Google Firebase rule productive
| * | [Enhancement] Make Google Firebase rule productivetwesterhever2023-05-261-2/+2
| |/
* | Merge pull request #4495 from twesterhever/temp-onoin-urlVsevolod Stakhov2023-06-041-1/+1
|\ \ | | | | | | [Minor] Move HAS_ONION_URI from "experimental" to "url" group
| * | [Minor] Move HAS_ONION_URI from "experimental" to "url" grouptwesterhever2023-05-261-1/+1
| |/
* | Apply suggestions from code reviewVsevolod Stakhov2023-06-032-3/+3
| |
* | [Minor] Fix description of MIME_HTML_ONLYtwesterhever2023-06-021-1/+1
| | | | | | | | Thanks, @moisseev!
* | [Minor] Improve various rule descriptionstwesterhever2023-05-265-75/+71
|/
* [Feature] Add controller endpoint to get fuzzy hashes from messagesVsevolod Stakhov2023-05-202-0/+47
| | | | | | | | | | | | | | | | | | | | | | | | | | | Sample usage: ``` curl -XPOST 'http://localhost:11334/plugins/fuzzy/hashes?flag=1' --data-binary '@-' < file ``` Sample output: ```json { "hashes": { "local": [ "24b6e7de2f489778d828c827079c48bacb086f816d0a7acabbe42e8d0da703b89b913176ad67eefaf5b54fa59f5e0ecfc7015846c4043fcfb0c7a4ed7a235025", "72789777cbec926f4143de4c08c87acc3fbf3b909b5c39f1edcf82ed12e2d8bc2f56be8d68ee681feccf44ca04e3eca5b8ec039cb84a0d40e22258c370a10cbb" ], "rspamd.com": [ "24b6e7de2f489778d828c827079c48bacb086f816d0a7acabbe42e8d0da703b89b913176ad67eefaf5b54fa59f5e0ecfc7015846c4043fcfb0c7a4ed7a235025", "72789777cbec926f4143de4c08c87acc3fbf3b909b5c39f1edcf82ed12e2d8bc2f56be8d68ee681feccf44ca04e3eca5b8ec039cb84a0d40e22258c370a10cbb" ], }, "success": true } ``` Issue: #4489
* [Minor] Account for one more undisclosed-recipients address variantAnton Yuzhaninov2023-02-251-1/+2
|
* Merge branch 'master' into temp-add-ipfs-heuristicsVsevolod Stakhov2023-02-209-12/+37
|\
| * add Betterbird to `user_agent_thunderbird`georglauterbach2023-02-191-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | See https://github.com/Betterbird/thunderbird-patches/issues/125 for reference. This way, Rspamd will not add `FORGED_MUA_MOZILLA_MAIL_MSGID_UNKNOWN` to mails sent perfectly find with Betterbird. Betterbird (<https://www.betterbird.eu/>) is an adjusted version of Thunderbird, fixing many bugs and adding long-wanted features. It is a common and well-known alternative to Thunderbird, so I think the addition is justified.
| * Merge pull request #4397 from twesterhever/temp-misc-cleanups-and-housekeepingVsevolod Stakhov2023-02-176-6/+3
| |\ | | | | | | [Minor] Assorted cleanup and housekeeping of configuration files
| | * [Minor] Fix some whitespace issuestwesterhever2023-02-176-6/+3
| | |
| * | Merge pull request #4401 from twesterhever/temp-google-firebaseVsevolod Stakhov2023-02-171-0/+7
| |\ \ | | | | | | | | [Enhancement] Add rule to detect Google Firebase URLs
| | * | [Enhancement] Add rule to detect Google Firebase URLstwesterhever2023-02-171-0/+7
| | |/
| * / [Enhancement] Make Google URL redirection rules productivetwesterhever2023-02-171-5/+5
| |/
| * Fix pcall() argument in rspamd.luadpetrov672023-02-141-1/+1
| |
| * [Fix] received: filtering of artificial headerKako, Chang2023-01-121-1/+1
| |
| * [Rules] Mid: Add MID_END_EQ_FROM_USER_PART ruleVsevolod Stakhov2022-12-231-0/+21
| | | | | | | | Issue: #4299
| * [Minor] Use unicode property for currency detectionVsevolod Stakhov2022-10-291-1/+1
| | | | | | | | Issue: #4320
| * [Rules] Reduce score of HTTP_TO_HTTPS - subject to remove completelyVsevolod Stakhov2022-10-181-1/+1
| |
* | [Minor] Regexp is case-insensitive, omit redundant characterstwesterhever2022-11-061-1/+1
| |
* | [Minor] Fix rule commenttwesterhever2022-11-061-1/+1
| |
generated by cgit v1.2.3 (git 2.39.1) at 2024-12-23 19:19:19 +0000