Custom Signature for Email Headers

[clewis1]

I am trying  to create a custom signature with the purpose of preventing malicious/phishing/spam emails with the firewall before it hits our mail gateway. For the most part we have been successful with this technique but I am struggling with creating a signature to essentially work as a wildcard. If anyone could take a look at my scenario and provide any feedback it would be much appreciated. Below is my example:

Scenairo: we are receiveing unwanted emais from the following email address

scanner@abc.domain.com

scanner@abcd.domain.com

scanner@abcde.domain.com

scanner@aaa.domain.com

scanner@bbb.domain.com

scanner@ccc.domain.com

As you can see the consistent parts of this type email campaign is the scanner@abc.domain.com. I am hoping to come up with a signature using email headers to wildcard the 'abc, abcd,abcda, etc'  as I dont want to be writing individual signatures for each sub domain as this could include upto 15 different representations of 'abc'.

I thought this would work scanner@(.*)(\.domain\.com) but does not appear to be the case.

[rcole]

Good afternoon!

I would try:

scanner@[a-z]+\.domain\.com

This operates under the assumption that the child domain under domain.com consists of any number of the characters a-z.

[clewis1]

Thanks rcole. I will give this a shot.

[clewis1]

Unfortunately this signature did not work either.

[rcole]

Hi clewis.

I tested this signature in a lab with every variant of the domain you provided, and it triggered in each instance.

Do you have a packet capture of the offending traffic?

[jambulo]

I've been using this method for a while successfully...

 

[clewis1]

I think I may be having an issue with decryption which may be casuing the issue. Just getting back around to looking at this one