From 84384ae4e65ff85b0feedd00ec27506dd5b9dbc7 Mon Sep 17 00:00:00 2001
From: Vsevolod Stakhov <vsevolod@highsecure.ru>
Date: Thu, 19 Sep 2019 12:13:48 +0100
Subject: [Conf] Make LEAKED_PASSWORD_SCAM a composite rule again

---
 conf/composites.conf | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

(limited to 'conf/composites.conf')

diff --git a/conf/composites.conf b/conf/composites.conf
index 37b1c3da9..2204f1e71 100644
--- a/conf/composites.conf
+++ b/conf/composites.conf
@@ -148,7 +148,13 @@ composites {
     score = 0.0;
     policy = "remove_weight";
   }
-
+  LEAKED_PASSWORD_SCAM {
+    description = "Contains BTC wallet address and scam patterns";
+    expression = "BITCOIN_ADDR & (LEAKED_PASSWORD_SCAM_RE | R_MIXED_CHARSET | R_EMPTY_IMAGE)";
+    policy = "leave";
+    score = 7.0;
+    group = "scams";
+  }
 
   .include(try=true; priority=1; duplicate=merge) "$LOCAL_CONFDIR/local.d/composites.conf"
   .include(try=true; priority=10) "$LOCAL_CONFDIR/override.d/composites.conf"
-- 
cgit v1.2.3