From 2fa03199e4bcf3d323d5c94ec7a16bb2890e0354 Mon Sep 17 00:00:00 2001 From: Vsevolod Stakhov Date: Fri, 22 May 2020 13:02:32 +0100 Subject: [Minor] Add rules that observes limits in pdf files --- conf/scores.d/content_group.conf | 40 +++++++++++++++++++++++++--------------- 1 file changed, 25 insertions(+), 15 deletions(-) (limited to 'conf') diff --git a/conf/scores.d/content_group.conf b/conf/scores.d/content_group.conf index b53ec31d0..6a011b938 100644 --- a/conf/scores.d/content_group.conf +++ b/conf/scores.d/content_group.conf @@ -18,20 +18,30 @@ description = "Content rules"; symbols = { - "PDF_ENCRYPTED" { - weight = 0.3; - description = "There is an encrypted PDF in the message"; - one_shot = true; - } - "PDF_JAVASCRIPT" { - weight = 0.1; - description = "There is an PDF with JavaScript in the message"; - one_shot = true; - } - "PDF_SUSPICIOUS" { - weight = 4.5; - description = "There is an PDF with suspicious properties in the message"; - one_shot = true; - } + "PDF_ENCRYPTED" { + weight = 0.3; + description = "There is an encrypted PDF in the message"; + one_shot = true; + } + "PDF_JAVASCRIPT" { + weight = 0.1; + description = "There is an PDF with JavaScript in the message"; + one_shot = true; + } + "PDF_SUSPICIOUS" { + weight = 4.5; + description = "There is an PDF with suspicious properties in the message"; + one_shot = true; + } + "PDF_LONG_TRAILER" { + weight = 0.2; + description = "There is an PDF with a long trailer"; + one_shot = true; + } + "PDF_MANY_OBJECTS" { + weight = 0; + description = "There is a PDF file with too many objects"; + one_shot = true; + } } -- cgit v1.2.3