Can someone pls verify if the below rule is fine?

Problems/questions regarding the MailCleaner configuration

Moderators: FlorianB, Pascal, bourgeois, mentor

blason
Posts: 161
Joined: Wed Mar 06, 2013 7:45 am
How did you hear about Mailcleaner: Internet

Can someone pls verify if the below rule is fine?

Postby blason » Mon Sep 12, 2016 7:31 pm

Hi Guys,

I quickly need to block or quarantine mails with Subject Please find attached invoice no:

Can someone confirm if this is OK?

header LOCKY1 Subject =~ /Please find attached invoice no\:/i
describe LOCKY1 Locky Ransomware Mail
score LOCKY1 6.0
User avatar
Martijn
Posts: 38
Joined: Wed Aug 20, 2014 5:31 pm
How did you hear about Mailcleaner: We love to work with Mailcleaner
Location: Enter - Netherlands
Contact:

Re: Can someone pls verify if the below rule is fine?

Postby Martijn » Tue Sep 13, 2016 8:40 am

If you implement Sane Security updates these scam would be blocked.
Works like a charm!
Image
blason
Posts: 161
Joined: Wed Mar 06, 2013 7:45 am
How did you hear about Mailcleaner: Internet

Re: Can someone pls verify if the below rule is fine?

Postby blason » Tue Sep 13, 2016 8:46 am

Oh yeah. I already have that implemented but wanted to ensure that nothing slips.
BTW does any one have any clue where are the quarantined files stored which are captured by sanesecurity? Or all those gets deleted?
User avatar
Martijn
Posts: 38
Joined: Wed Aug 20, 2014 5:31 pm
How did you hear about Mailcleaner: We love to work with Mailcleaner
Location: Enter - Netherlands
Contact:

Re: Can someone pls verify if the below rule is fine?

Postby Martijn » Tue Sep 13, 2016 9:17 am

For as far as I know it's just quarantained in the quarantaine folder.

See topic: viewtopic.php?f=12&t=2371
Image

Return to “Configuration”

Who is online

Users browsing this forum: Bing [Bot] and 1 guest