65 lines
3.3 KiB
ERB
65 lines
3.3 KiB
ERB
###########################################################################
|
|
# Kosmos custom SpamAssassin rules
|
|
#
|
|
# The rules below are designed to be individually weak but combine via meta
|
|
# rules into strong, low-FP signals.
|
|
###########################################################################
|
|
|
|
# --- Individual signals --------------------------------------------------
|
|
|
|
# URLs of the form https://////////////... (3+ slashes after the scheme).
|
|
# Legitimate mailers never produce this; it is an obfuscation artefact.
|
|
rawbody KOSMOS_MULTI_SLASH_URL /https?:\/{3,}/
|
|
describe KOSMOS_MULTI_SLASH_URL URL with three or more consecutive slashes
|
|
|
|
# Authoring-tool fingerprint left in the HTML by the spam toolchain.
|
|
body KOSMOS_MSHTML_11_9600 /MSHTML 11\.00\.9600\.17037/
|
|
describe KOSMOS_MSHTML_11_9600 HTML generated by MSHTML 11.00.9600.17037
|
|
|
|
# Display name pattern used by the campaign.
|
|
header KOSMOS_FROM_LUXURY_GOODS From:name =~ /Luxury (Watches|Bags|Handbags|Timepieces)\b/i
|
|
describe KOSMOS_FROM_LUXURY_GOODS From display name advertises luxury goods
|
|
|
|
# Base64-encoded unsubscribe links: return.php?p=<long base64>
|
|
uri KOSMOS_RETURN_PHP_B64 /return\.php\?p=[A-Za-z0-9+\/=%]{20,}/
|
|
describe KOSMOS_RETURN_PHP_B64 Base64-encoded return.php unsubscribe link
|
|
|
|
# Fabricated "security" headers injected to evade heuristic filters.
|
|
# No legitimate MTA or mailing-list manager emits these.
|
|
header KOSMOS_FAKE_HDR_PHISHSIM exists:X-PhishSimulator-Mode
|
|
header KOSMOS_FAKE_HDR_DECEPTION exists:X-Deception-Asset-Type
|
|
header KOSMOS_FAKE_HDR_OBFUSCATION exists:X-Obfuscation-Trace-ID
|
|
header KOSMOS_FAKE_HDR_QUARANTINE exists:X-Quarantine-Reason-Code
|
|
header KOSMOS_FAKE_HDR_TRUST exists:X-Behavioral-Trust-Index
|
|
|
|
# --- Scores for individual signals --------------------------------------
|
|
score KOSMOS_MULTI_SLASH_URL 2.0
|
|
score KOSMOS_MSHTML_11_9600 1.2
|
|
score KOSMOS_FROM_LUXURY_GOODS 0.5
|
|
score KOSMOS_RETURN_PHP_B64 1.5
|
|
score KOSMOS_FAKE_HDR_PHISHSIM 1.0
|
|
score KOSMOS_FAKE_HDR_DECEPTION 1.0
|
|
score KOSMOS_FAKE_HDR_OBFUSCATION 1.0
|
|
score KOSMOS_FAKE_HDR_QUARANTINE 1.0
|
|
score KOSMOS_FAKE_HDR_TRUST 1.0
|
|
|
|
# --- Meta rules ----------------------------------------------------------
|
|
|
|
# Core campaign signature: luxury-goods From name + MSHTML fingerprint +
|
|
# HTML-only body. Covers the bulk of the campaign corpus.
|
|
meta KOSMOS_LUXURY_SPAM_CAMPAIGN (KOSMOS_FROM_LUXURY_GOODS && KOSMOS_MSHTML_11_9600 && MIME_HTML_ONLY)
|
|
describe KOSMOS_LUXURY_SPAM_CAMPAIGN Luxury-goods From + MSHTML 11.00.9600 + HTML-only
|
|
score KOSMOS_LUXURY_SPAM_CAMPAIGN 3.5
|
|
|
|
# Luxury-goods From name combined with a suspicious URI signal or a
|
|
# Spamhaus-listed relay.
|
|
meta KOSMOS_LUXURY_SPAM_URI (KOSMOS_FROM_LUXURY_GOODS && (KOSMOS_MULTI_SLASH_URL || KOSMOS_RETURN_PHP_B64 || RCVD_IN_SBL_CSS))
|
|
describe KOSMOS_LUXURY_SPAM_URI Luxury-goods From + suspicious URI or SBL relay
|
|
score KOSMOS_LUXURY_SPAM_URI 2.5
|
|
|
|
# Two or more fabricated "security" headers. Genuine mail never carries
|
|
# these; their presence indicates a header-injection evasion kit.
|
|
meta KOSMOS_FAKE_SECURITY_HEADERS (KOSMOS_FAKE_HDR_PHISHSIM + KOSMOS_FAKE_HDR_DECEPTION + KOSMOS_FAKE_HDR_OBFUSCATION + KOSMOS_FAKE_HDR_QUARANTINE + KOSMOS_FAKE_HDR_TRUST >= 2)
|
|
describe KOSMOS_FAKE_SECURITY_HEADERS Two or more fabricated security headers
|
|
score KOSMOS_FAKE_SECURITY_HEADERS 4.0
|