#LAST UPDATED 09/28/2010

#--------------------------------------------------------------------#
#			EXCEPTIONS	    	 		     #
#--------------------------------------------------------------------#

TESTSFAILED	END	PCRE	((FILT|SNIFF)ER-(SCAMS?|LOTTO))
TESTSFAILED	END	PCRE	(FILTER-(LOTTO|PHISH))
TESTSFAILED	END	PCRE	(FILTER-SCAMS?)

#--------------------------------------------------------------------#
#			ATTACHMENTS	    	 		     #
#--------------------------------------------------------------------#

BODY		END	PCRE	(?i:"(.+)?(?:urgent|notification|from\b|(q[cdfghjkmnoprstvxyz]|[vwtj]q|x[djkrz]|z[bcfjkm])).+\.(doc|pdf)")

#ADOBE
BODY	-7		PCRE	(?i:Content-Type: application/pdf;)
BODY	-7		PCRE	(?i:Content-Disposition: attachment; filename=\w.*\.pdf)

#MICROSOFT
BODY	-10		PCRE	(?i:Content-Type: application/(vnd\.(ms-|openxmlformats)|ms(word|excel)))

BODY	-5		PCRE	((BEGIN|END):VCALENDAR)

#MAC
BODY	-10		PCRE	(?i:content-type: application/(applefile|mac-binhex40|postscript))
BODY	-10		PCRE	(?i:content-type: application/x-(ms(-excel|-wmz|download|excel)|macbinary))

#AUDIO
BODY	-10		PCRE	(?i:Content-Description: Voicemail sound attachment)
#BODY	-10		PCRE	(?i:content-type: audio/(x-(midi|mpeg|wav)|mpeg))

#VIDEO
BODY	-10		PCRE	(?i:content-type: video/(avi|mpg|mpeg))
BODY	-10		PCRE	(?i:content-type: video/(x-(ms-asf|ms-wmv|msvideo|mpeg)))

#OTHER
BODY	-10		PCRE	(?i:Content-Type: (application|text)/(rtf|richtext|x-vcard))

#ZIP
#BODY 	-10		PCRE	(?i:content-type: application/(x-zip-compressed|zip|x-stuffit))

#NOTIFICATIONS
BODY	WHITELIST	PCRE	(?i:(Content-Type: message/|report-type=)disposition-notification)
BODY	-5		PCRE	(?i:This is an automatically generated Delivery Status Notification.)

#MINOLTA FAX
BODY	-20		PCRE	(?i:KONICA_MINOLTA_Internet_Fax_Boundary)
