[clamav-users] Signature matching email Subject:

[Steve Basford]

On Fri, May 23, 2014 4:25 pm, Claudio Cuqui wrote:
> Hello there !
>
>
> I would like to known if is it possible to create a virus signature that
> match the subject of a mail message. I tried everything and the signature
> only match when the pattern is located in the email body.
>

Something like this...

Spam.Subject.001:4:*:5375626A6563743A{-50}4D617373205370616D205375626A656374

Which will match...

Subject: (any 50 chars)Mass Spam Subject

Cheers,

Steve
Sanesecurity