Re: Signature false positive update #2590

> False Positives: Any time a message contains "MAIL FROM" in any part of the
> body this rule will trigger. The words "email from" are extremely common in
> disclaimers and bulk ads. Any large site will see false positives on this
> signature thousands of times per week.

Can you try this change at let me know if it solves some of your false
positives please?

replace this:
    content:"MAIL FROM"; nocase; isdataat:260; content:!"|0A|"; within:256; 
with this:
    content:"MAIL"; nocase; isdataat:260; pcre:"/^MAIL\s+FROM[^\n]{256}/smi";

thanks,
Brian


-------------------------------------------------------
This SF.net email is sponsored by: IT Product Guide on ITManagersJournal
Use IT products in your business? Tell us what you think of them. Give us
Your Opinions, Get Free ThinkGeek Gift Certificates! Click to find out more
http://productguide.itmanagersjournal.com/guidepromo.tmpl