Add custom spam rules

Targeting known campaigns
2026-08-17 14:58:42 -06:00
parent 413f02d9c1
commit eae40fd55b
2 changed files with 70 additions and 0 deletions
@@ -29,6 +29,12 @@ template "/etc/spamassassin/local.cf" do
  notifies :restart, "service[spamassassin]", :delayed
 end

+template "/etc/spamassassin/kosmos.cf" do
+  source "spamassassin_kosmos.cf.erb"
+  mode   0644
+  notifies :restart, "service[spamassassin]", :delayed
+end
+
 service "spamassassin" do
  action [:enable, :start]
 end
@@ -0,0 +1,64 @@
+###########################################################################
+# Kosmos custom SpamAssassin rules
+#
+# The rules below are designed to be individually weak but combine via meta
+# rules into strong, low-FP signals.
+###########################################################################
+
+# --- Individual signals --------------------------------------------------
+
+# URLs of the form https://////////////... (3+ slashes after the scheme).
+# Legitimate mailers never produce this; it is an obfuscation artefact.
+rawbody KOSMOS_MULTI_SLASH_URL /https?:\/{3,}/
+describe KOSMOS_MULTI_SLASH_URL URL with three or more consecutive slashes
+
+# Authoring-tool fingerprint left in the HTML by the spam toolchain.
+body KOSMOS_MSHTML_11_9600 /MSHTML 11\.00\.9600\.17037/
+describe KOSMOS_MSHTML_11_9600 HTML generated by MSHTML 11.00.9600.17037
+
+# Display name pattern used by the campaign.
+header KOSMOS_FROM_LUXURY_GOODS From:name =~ /Luxury (Watches|Bags|Handbags|Timepieces)\b/i
+describe KOSMOS_FROM_LUXURY_GOODS From display name advertises luxury goods
+
+# Base64-encoded unsubscribe links: return.php?p=<long base64>
+uri KOSMOS_RETURN_PHP_B64 /return\.php\?p=[A-Za-z0-9+\/=%]{20,}/
+describe KOSMOS_RETURN_PHP_B64 Base64-encoded return.php unsubscribe link
+
+# Fabricated "security" headers injected to evade heuristic filters.
+# No legitimate MTA or mailing-list manager emits these.
+header KOSMOS_FAKE_HDR_PHISHSIM    exists:X-PhishSimulator-Mode
+header KOSMOS_FAKE_HDR_DECEPTION   exists:X-Deception-Asset-Type
+header KOSMOS_FAKE_HDR_OBFUSCATION exists:X-Obfuscation-Trace-ID
+header KOSMOS_FAKE_HDR_QUARANTINE  exists:X-Quarantine-Reason-Code
+header KOSMOS_FAKE_HDR_TRUST       exists:X-Behavioral-Trust-Index
+
+# --- Scores for individual signals --------------------------------------
+score KOSMOS_MULTI_SLASH_URL   2.0
+score KOSMOS_MSHTML_11_9600    1.2
+score KOSMOS_FROM_LUXURY_GOODS 0.5
+score KOSMOS_RETURN_PHP_B64    1.5
+score KOSMOS_FAKE_HDR_PHISHSIM    1.0
+score KOSMOS_FAKE_HDR_DECEPTION   1.0
+score KOSMOS_FAKE_HDR_OBFUSCATION 1.0
+score KOSMOS_FAKE_HDR_QUARANTINE  1.0
+score KOSMOS_FAKE_HDR_TRUST       1.0
+
+# --- Meta rules ----------------------------------------------------------
+
+# Core campaign signature: luxury-goods From name + MSHTML fingerprint +
+# HTML-only body. Covers the bulk of the campaign corpus.
+meta KOSMOS_LUXURY_SPAM_CAMPAIGN (KOSMOS_FROM_LUXURY_GOODS && KOSMOS_MSHTML_11_9600 && MIME_HTML_ONLY)
+describe KOSMOS_LUXURY_SPAM_CAMPAIGN Luxury-goods From + MSHTML 11.00.9600 + HTML-only
+score KOSMOS_LUXURY_SPAM_CAMPAIGN 3.5
+
+# Luxury-goods From name combined with a suspicious URI signal or a
+# Spamhaus-listed relay.
+meta KOSMOS_LUXURY_SPAM_URI (KOSMOS_FROM_LUXURY_GOODS && (KOSMOS_MULTI_SLASH_URL || KOSMOS_RETURN_PHP_B64 || RCVD_IN_SBL_CSS))
+describe KOSMOS_LUXURY_SPAM_URI Luxury-goods From + suspicious URI or SBL relay
+score KOSMOS_LUXURY_SPAM_URI 2.5
+
+# Two or more fabricated "security" headers. Genuine mail never carries
+# these; their presence indicates a header-injection evasion kit.
+meta KOSMOS_FAKE_SECURITY_HEADERS (KOSMOS_FAKE_HDR_PHISHSIM + KOSMOS_FAKE_HDR_DECEPTION + KOSMOS_FAKE_HDR_OBFUSCATION + KOSMOS_FAKE_HDR_QUARANTINE + KOSMOS_FAKE_HDR_TRUST >= 2)
+describe KOSMOS_FAKE_SECURITY_HEADERS Two or more fabricated security headers
+score KOSMOS_FAKE_SECURITY_HEADERS 4.0