topic Re: Custom Signature for Email Headers in Custom Signatures

Custom Signature for Email Headers

clewis1 — Wed, 01 Jun 2016 17:29:05 GMT

I am trying to create a custom signature with the purpose of preventing malicious/phishing/spam emails with the firewall before it hits our mail gateway. For the most part we have been successful with this technique but I am struggling with creating a signature to essentially work as a wildcard. If anyone could take a look at my scenario and provide any feedback it would be much appreciated. Below is my example:

Scenairo: we are receiveing unwanted emais from the following email address

scanner@abc.domain.com

scanner@abcd.domain.com

scanner@abcde.domain.com

scanner@aaa.domain.com

scanner@bbb.domain.com

scanner@ccc.domain.com

As you can see the consistent parts of this type email campaign is the scanner@abc.domain.com. I am hoping to come up with a signature using email headers to wildcard the 'abc, abcd,abcda, etc' as I dont want to be writing individual signatures for each sub domain as this could include upto 15 different representations of 'abc'.

I thought this would work scanner@(.*)(\.domain\.com) but does not appear to be the case.

Re: Custom Signature for Email Headers

rcole — Wed, 01 Jun 2016 18:03:23 GMT

Good afternoon!

I would try:

scanner@[a-z]+\.domain\.com

This operates under the assumption that the child domain under domain.com consists of any number of the characters a-z.

Re: Custom Signature for Email Headers

clewis1 — Thu, 02 Jun 2016 14:25:52 GMT

Thanks rcole. I will give this a shot.

Re: Custom Signature for Email Headers

clewis1 — Thu, 02 Jun 2016 14:57:33 GMT

Unfortunately this signature did not work either.

Re: Custom Signature for Email Headers

rcole — Thu, 02 Jun 2016 15:02:14 GMT

Hi clewis.

I tested this signature in a lab with every variant of the domain you provided, and it triggered in each instance.

Do you have a packet capture of the offending traffic?

Re: Custom Signature for Email Headers

jambulo — Wed, 08 Jun 2016 20:32:19 GMT

I've been using this method for a while successfully...

Re: Custom Signature for Email Headers

clewis1 — Wed, 15 Jun 2016 10:56:35 GMT

I think I may be having an issue with decryption which may be casuing the issue. Just getting back around to looking at this one