<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii">
<TITLE>Blank Stationery</TITLE>
<META content="MSHTML 6.00.2800.1170" name=GENERATOR></HEAD>
<BODY style="FONT-SIZE: 10pt; COLOR: #000000; FONT-FAMILY: Lucida Console"
background="">
<DIV><SPAN class=725540121-25082003>John:</SPAN></DIV>
<DIV><SPAN class=725540121-25082003></SPAN> </DIV>
<DIV><SPAN class=725540121-25082003>I'm logging a message when rules in the
local-rules gets a hit. I build a report by greping the number of times
the phrase "Trapped poisoned" exists in the Procmail log. If a message
gets a hit in the local-rules, will it skip the "Trapped poisoned
executable" test, or am I double counting?</SPAN></DIV>
<DIV><SPAN class=725540121-25082003></SPAN> </DIV>
<DIV><SPAN class=725540121-25082003><<Dan>></SPAN></DIV>
<DIV><SPAN class=725540121-25082003></SPAN> </DIV>
<DIV><SPAN class=725540121-25082003>Attached is reporting script and my
local-rules</SPAN></DIV>
<DIV><SPAN class=725540121-25082003></SPAN> </DIV>
<DIV><SPAN
class=725540121-25082003>====================================================</SPAN></DIV>
<DIV><SPAN class=725540121-25082003>root: cat /usr/sbin/mailstats</SPAN></DIV>
<DIV><SPAN class=725540121-25082003>echo " "<BR>echo " "<BR>echo "Lewis Spam and
Sanitizer Summary for $(date --date=yesterday '+%b %d')"<BR>echo " "<BR>echo
"Count Non-spam (ham) Messages"<BR>egrep -c "clean message"
/var/log/maillog<BR>echo Count Spam Messages<BR>egrep -c "identified spam"
/var/log/maillog<BR>echo -------------------<BR>echo Count Klez Trapped<BR>egrep
-ic "Trapped: Probable Klez" /var/log/procmail<BR>echo Count BugBear
Trapped<BR>egrep -ic "Trapped: Probable BugBear" /var/log/procmail<BR>echo Count
SoBig Trapped<BR>egrep -ic "Trapped: Probable SoBig" /var/log/procmail<BR>echo
Count MiMail Trapped<BR>egrep -ic "Trapped: Probable MiMail"
/var/log/procmail<BR>echo Count Stripped Files<BR>egrep -ic "Stripped "
/var/log/procmail<BR>echo Count Poisoned Files<BR>egrep -ic "Trapped poisoned"
/var/log/procmail<BR>echo Count Excessively Long Headers<BR>egrep -ic "Trapped
excessively" /var/log/procmail<BR>echo -------------------<BR>echo Sanitizer
Warnings<BR>egrep "^WARN: " /var/log/procmail<BR>echo Trapped Excessive
Headers<BR>egrep "Trapped excessively" /var/log/procmail<BR>echo
-------------------<BR></SPAN></DIV>
<DIV><SPAN
class=725540121-25082003>===============================================</DIV></SPAN>
<DIV><SPAN class=725540121-25082003>root: cat local-rules.procmail<BR>## Catch
Cytron E-Card worm (10/29/2002)<BR>:0<BR>* >
110000<BR>{<BR> :0
B<BR> * You Have Received an
E-Card<BR>
{<BR> LOG="TRAPPED: Cytron
E-Card worm"<BR> :0
hfi<BR> | formail -A
"X-Content-Security: [${HOST}] NOTIFY"
\<BR>
-A "X-Content-Security: [${HOST}] QUARANTINE"
\<BR>
-A "X-Content-Security: [${HOST}] REPORT: Trapped Cytron E-Card
worm"<BR> }<BR>}</SPAN></DIV>
<DIV> </DIV>
<DIV><SPAN class=725540121-25082003># Detect Hybris when sent as an anonymous
message.<BR>#<BR>:0<BR>* > 20000<BR>* !^Subject:<BR>* !^To:<BR>*
^Content-Type:.*multipart/mixed;<BR>{<BR>
:0 B<BR> * 1^1
^Content-Disposition:.*\.EXE<BR> * 1^1
^Content-Type:.*\.EXE<BR>
{<BR> LOG="TRAPPED:
Anonymous Executable (Hybris)"<BR> :0
hfi<BR> | formail -A
"X-Content-Security: [${HOST}] NOTIFY"
\<BR>
-A "X-Content-Security: [${HOST}] QUARANTINE"
\<BR>
-A "X-Content-Security: [${HOST}] REPORT: Trapped (Hybris) anonymous
executable"<BR> }<BR>}</SPAN></DIV>
<DIV> </DIV>
<DIV><SPAN class=725540121-25082003># Trap SirCam (signature as of
08/01/2001)<BR>#<BR>:0<BR>* > 130000<BR>*
^Content-Type:.*multipart/mixed;<BR>{<BR>
:0 B<BR> * ^Content-Disposition:
attachment;<BR> *
^Content-Transfer-Encoding: base64<BR>
*
AAAAGgU0NhbTMyABCDTUlN|AAAAAaBTQ2FtMzIAEINNSU1F|ABkAAAABoFNDYW0zMgAQg01J<BR>
{<BR> LOG="TRAPPED: SirCam
worm "<BR> :0
hfi<BR> | formail -A
"X-Content-Security: [$HOST] NOTIFY"
\<BR>
-A "X-Content-Security: [$HOST] DISCARD"
\<BR>
-A "X-Content-Security: [$HOST] REPORT: Trapped SirCam
worm"<BR> }<BR>}</SPAN></DIV>
<DIV> </DIV>
<DIV><SPAN class=725540121-25082003># Trap BadTrans (signature as of
11/26/2001)<BR>#<BR>:0<BR>* > 40000<BR>* < 50000<BR>* ^Subject: Re:<BR>*
^Content-Type:.*multipart/.*boundary="====_ABC1234567890DEF_===="<BR>{<BR>
:0 B<BR> * ^Content-Type:
audio/x-wav;<BR> * ^Content-ID:
<EA4DMGBP9p><BR> *
^Content-Transfer-Encoding: base64<BR>
{<BR> LOG="TRAPPED:
BadTrans worm "<BR> :0
hfi<BR> | formail -A
"X-Content-Security: [$HOST] NOTIFY"
\<BR>
-A "X-Content-Security: [$HOST] DISCARD"
\<BR>
-A "X-Content-Security: [$HOST] REPORT: Trapped BadTrans
worm"<BR> }<BR>}</SPAN></DIV>
<DIV> </DIV>
<DIV><SPAN class=725540121-25082003># Trap Klez (signature as of
04/26/2002)<BR># Trap BugBear (signature as of 10/06/2002)<BR>#<BR>:0<BR>* >
50000<BR>*
^Content-Type:.*multipart/alternative;<BR>{<BR>
:0 B<BR> * \<i?frame
+src=(3D)?cid:.* height=(3D)?[0-9]
+width=(3D)?[0-9]><BR> *
^Content-Type:.*audio/<BR> *
^Content-ID:.*<<BR> *
^Content-Transfer-Encoding: base64<BR>
* ^TVqQAAMAAAAEAAAA<BR>
{<BR>
:0<BR>
* >
100000<BR>
{<BR>
LOG="TRAPPED: Probable Klez worm
"<BR>
:0
hfi<BR>
| formail -A "X-Content-Security: [$HOST] NOTIFY"
\<BR>
-A "X-Content-Security: [$HOST] DISCARD"
\<BR>
-A "X-Content-Security: [$HOST] REPORT: Trapped probable Klez
worm"<BR>
}<BR>
:0
E<BR>
* >
50000<BR>
{<BR>
LOG="TRAPPED: Probable BugBear worm
"<BR>
:0
hfi<BR>
| formail -A "X-Content-Security: [$HOST] NOTIFY"
\<BR>
-A "X-Content-Security: [$HOST] DISCARD"
\<BR>
-A "X-Content-Security: [$HOST] REPORT: Trapped probable BugBear
worm"<BR>
}<BR> }</SPAN></DIV>
<DIV> </DIV>
<DIV><SPAN class=725540121-25082003>
:0 B E<BR> * H ?? ^Subject: A(
(special|very))?[ ][ ][a-z]<BR> *
^Content-Type:.*application/octet-stream<BR>
* ^Content-ID:<BR> *
^Content-Transfer-Encoding: base64<BR>
* ^TVqQAAMAAAAEAAAA<BR>
{<BR> LOG="TRAPPED:
Probable Klez worm "<BR>
:0 hfi<BR> | formail -A
"X-Content-Security: [$HOST] NOTIFY"
\<BR>
-A "X-Content-Security: [$HOST] DISCARD"
\<BR>
-A "X-Content-Security: [$HOST] REPORT: Trapped probable Klez
worm"<BR> }<BR>}</SPAN></DIV>
<DIV> </DIV>
<DIV><SPAN class=725540121-25082003># Attempt to trap sendmail header exploit
(signature as of 03/05/3003)<BR>#<BR># CRITICAL NOTE: this WILL NOT protect the
system it is installed on.<BR># It is intended to prevent a patched Sendmail
from relaying an attack<BR># message onwards.<BR>#<BR>:0<BR>*
^((resent-)?(sender|from|(reply-)?to|cc|bcc)|(errors|disposition-notification|apparently)-to|Return-Path):
.*<>.*<>.*<>.*<>.*<>.*\(.*\)<BR>{<BR>
LOG="TRAPPED: Probable Sendmail header exploit "<BR> :0
hfi<BR> | formail -A "X-Content-Security: [$HOST] NOTIFY"
\<BR>
-A "X-Content-Security: [$HOST] QUARANTINE"
\<BR>
-A "X-Content-Security: [$HOST] REPORT: Trapped possible sendmail header
exploit"<BR>}</SPAN></DIV>
<DIV> </DIV>
<DIV><SPAN class=725540121-25082003># Trap SoBig.F (signature as of
08/25/2003)<BR>#<BR>:0<BR>* > 100000<BR>* < 120000<BR>*
^Content-Type:.*multipart/mixed;<BR>{<BR>
:0 B<BR> * ^(Please )?see the attached
(zip )?file for details\.?<BR> *
^Content-Disposition: attachment;<BR>
* ^Content-Transfer-Encoding:
base64<BR> * 9876543210^1
^Content-(Type|Disposition):.*$.*name *=
*"?(your_details|application|document|screensaver|movie)[0-9]*\.(zip|pif|scr)"?<BR>
* 9876543210^1 ^Content-(Type|Disposition):.*name *=
*"?(your_details|application|document|screensaver|movie)[0-9]*\.(zip|pif|scr)"?<BR>
{<BR> LOG="TRAPPED:
Probable SoBig worm "<BR>
:0 hfi<BR> | formail -A
"X-Content-Security: [$HOST] NOTIFY"
\<BR>
-A "X-Content-Security: [$HOST] QUARANTINE"
\<BR>
-A "X-Content-Security: [$HOST] REPORT: Trapped SoBig worm - <A
href="http://securityresponse.symantec.com/avcenter/venc/data/w32.sobig.f@mm.html">http://securityresponse.symantec.com/avcenter/venc/data/w32.sobig.f@mm.html</A>"<BR>
}<BR>}</SPAN></DIV>
<DIV> </DIV>
<DIV><SPAN class=725540121-25082003># Trap backscatter from SoBig.F<BR>#<BR>:0
hfi<BR>* ^Subject: Undeliverable: *(Re: *)*(Approved|Details|(My|Your)
details|That movie|Thank you\!|Wicked screensaver|Your application)<BR>*
^FROM_MAILER<BR>| formail -A "X-Content-Security: [$HOST] NONOTIFY"
\<BR> -A
"X-Content-Security: [$HOST] DISCARD"
\<BR> -A
"X-Content-Security: [$HOST] REPORT: Trapped SoBig.F backscatter"</SPAN></DIV>
<DIV> </DIV>
<DIV><SPAN class=725540121-25082003># Trap MiMail (08/01/2003)<BR>#<BR>:0<BR>*
> 10000<BR>* < 50000<BR>* ^Content-Type:.*multipart/mixed;<BR>*
^From:.*admin@<BR>* ^Subject:.*your
account<BR>{<BR> :0
B<BR> * ^Content-Disposition:
attachment;<BR> *
^Content-Transfer-Encoding: base64<BR>
* 9876543210^1 ^Content-(Type|Disposition):.*name *=
*"?message\.zip"?<BR> * 9876543210^1
^Content-(Type|Disposition):.*$.*name *=
*"?message\.zip"?<BR>
{<BR> LOG="TRAPPED:
Probable MiMail worm "<BR>
:0 hfi<BR> | formail -A
"X-Content-Security: [$HOST] NOTIFY"
\<BR>
-A "X-Content-Security: [$HOST] QUARANTINE"
\<BR>
-A "X-Content-Security: [$HOST] REPORT: Trapped MiMail worm - <A
href="http://securityresponse.symantec.com/avcenter/venc/data/w32.mimail.a@mm.html">http://securityresponse.symantec.com/avcenter/venc/data/w32.mimail.a@mm.html</A>"<BR>
}<BR>}<BR></SPAN></DIV>
<DIV><SPAN class=725540121-25082003> </DIV></SPAN></BODY></HTML>