#
# 2007 Victor Ustugov <victor+spamassasin@corvax.kiev.ua>
#


meta		FORGED_MUA_MSO_CHARSET_SUBJECT		__CUST_X_Mailer_MSO1X && __FORGED_MUA_OE_CHARSET_SUBJECT
describe	FORGED_MUA_MSO_CHARSET_SUBJECT		Forged MUA Microsoft Outlook (charset with capital in beginning of header Subject)
score		FORGED_MUA_MSO_CHARSET_SUBJECT		1.0

meta		FORGED_MUA_MSO_CHARSET_FROM		__CUST_X_Mailer_MSO1X && __FORGED_MUA_OE_CHARSET_FROM
describe	FORGED_MUA_MSO_CHARSET_FROM		Forged MUA Microsoft Outlook (charset with capital in beginning of header From)
score		FORGED_MUA_MSO_CHARSET_FROM		1.0

meta		FORGED_MUA_MSO_CHARSET_REPLY_TO		__CUST_X_Mailer_MSO1X && __FORGED_MUA_OE_CHARSET_REPLY_TO
describe	FORGED_MUA_MSO_CHARSET_REPLY_TO		Forged MUA Microsoft Outlook (charset with capital in beginning of header Reply-To)
score		FORGED_MUA_MSO_CHARSET_REPLY_TO		1.0

meta		FORGED_MUA_MSO_CHARSET_TO		__CUST_X_Mailer_MSO1X && __FORGED_MUA_OE_CHARSET_TO
describe	FORGED_MUA_MSO_CHARSET_TO		Forged MUA Microsoft Outlook (charset with capital in beginning of header To)
score		FORGED_MUA_MSO_CHARSET_TO		1.0

meta		FORGED_MUA_MSO_CHARSET_CC		__CUST_X_Mailer_MSO1X && __FORGED_MUA_OE_CHARSET_CC
describe	FORGED_MUA_MSO_CHARSET_CC		Forged MUA Microsoft Outlook (charset with capital in beginning of header Cc)
score		FORGED_MUA_MSO_CHARSET_CC		1.0

######################################################################

meta		FORGED_MUA_MSO_FROM_WOUT_QUOTE		__CUST_X_Mailer_MSO1X && !__CUST_FROM_EMPTY && __HEADER_FROM_WITHOUT_QUOTES && !__HEADER_FROM_ENCODED
describe	FORGED_MUA_MSO_FROM_WOUT_QUOTE		Forged MUA Microsoft Outlook (there aren't double quotes in header From)
score		FORGED_MUA_MSO_FROM_WOUT_QUOTE		2.0

meta		FORGED_MUA_MSO_FROM			__CUST_X_Mailer_MSO1X && !__CUST_FROM_EMPTY && !__FROM_QUOTA_OR_ANGLE_BRACKET && !__HEADER_FROM_WITHOUT_QUOTES
describe	FORGED_MUA_MSO_FROM			Forged MUA Microsoft Outlook (header From does not contains double quote and angle bracket)
score		FORGED_MUA_MSO_FROM			2.0

meta		FORGED_MUA_MSO_REPLY_TO_WOUT_QUOTE	__CUST_X_Mailer_MSO1X && !__CUST_REPLY_TO_EMPTY && __HEADER_REPLY_TO_WITHOUT_QUOTES && !__HEADER_REPLY_TO_ENCODED && __CUST_List_Id_EMPTY
describe	FORGED_MUA_MSO_REPLY_TO_WOUT_QUOTE	Forged MUA Microsoft Outlook (there aren't double quotes in header Reply-To)
score		FORGED_MUA_MSO_REPLY_TO_WOUT_QUOTE	0.5

meta		FORGED_MUA_MSO_REPLY_TO			__CUST_X_Mailer_MSO1X && !__CUST_REPLY_TO_EMPTY && !__REPLY_TO_QUOTA_OR_ANGLE_BRACKET && !__HEADER_REPLY_TO_WITHOUT_QUOTES && __CUST_List_Id_EMPTY
describe	FORGED_MUA_MSO_REPLY_TO			Forged MUA Microsoft Outlook (header Reply-To does not contains double quote and angle bracket)
score		FORGED_MUA_MSO_REPLY_TO			2.0

meta		FORGED_MUA_MSO_TO_WOUT_QUOTE		__CUST_X_Mailer_MSO1X && !__CUST_TO_EMPTY && __HEADER_TO_WITHOUT_QUOTES && !__HEADER_TO_ENCODED && __CUST_List_Id_EMPTY
describe	FORGED_MUA_MSO_TO_WOUT_QUOTE		Forged MUA Microsoft Outlook (there aren't double quotes in header To)
score		FORGED_MUA_MSO_TO_WOUT_QUOTE		2.0

meta		FORGED_MUA_MSO_TO			__CUST_X_Mailer_MSO1X && !__CUST_TO_EMPTY && !__TO_QUOTA_OR_ANGLE_BRACKET && !__HEADER_TO_WITHOUT_QUOTES && __CUST_List_Id_EMPTY
describe	FORGED_MUA_MSO_TO			Forged MUA Microsoft Outlook (header To does not contains double quote and angle bracket)
score		FORGED_MUA_MSO_TO			2.0

meta		FORGED_MUA_MSO_CC_WOUT_QUOTE		__CUST_X_Mailer_MSO1X && !__CUST_CC_EMPTY && __HEADER_CC_WITHOUT_QUOTES && !__HEADER_CC_ENCODED
describe	FORGED_MUA_MSO_CC_WOUT_QUOTE		Forged MUA Microsoft Outlook (there aren't double quotes in header Cc)
score		FORGED_MUA_MSO_CC_WOUT_QUOTE		2.0

meta		FORGED_MUA_MSO_CC			__CUST_X_Mailer_MSO1X && !__CUST_CC_EMPTY && !__CC_QUOTA_OR_ANGLE_BRACKET && !__HEADER_CC_WITHOUT_QUOTES
describe	FORGED_MUA_MSO_CC			Forged MUA Microsoft Outlook (header Cc does not contains double quote and angle bracket)
score		FORGED_MUA_MSO_CC			2.0

######################################################################

#header		__MSO12_Message_ID			Message-ID:case =~ /^<0[\da-f]{3}[\da-f]{8}\$[\da-f]{8}\$[\da-f]{8}\$(\@[a-zA-Z\d_]+)?\@[^\@>]+>$/
#meta		FORGED_MUA_MSO12_Message_ID		__CUST_X_Mailer_MSO12 && !__MSO12_Message_ID
#describe	FORGED_MUA_MSO12_Message_ID		Forged MUA Microsoft Office Outlook 12
#score		FORGED_MUA_MSO12_Message_ID		2.5

header		__MSO12_Message_ID			Message-ID:case =~ /^<0[\da-f]{3}01[\da-f]{6}\$[\da-f]{8}\$[\da-f]{8}\$(\@[a-zA-Z\d_]+)?\@[^\@>]+>$/
header		__MSO12_From_Message_ID1		From|Message-ID:case =~ /^[^\.]+\@[^\.]+\.([^>]+)>[\s\r\n]*\|<0[\da-f]{3}01[\da-f]{6}\$[\da-f]{8}\$[\da-f]{8}\$\@\1>$/i
header		__MSO12_From_Message_ID2		From|Message-ID:case =~ /^.+\.(\S+\@[^>]+)>[\s\r\n]*\|<0[\da-f]{3}01[\da-f]{6}\$[\da-z]{8}\$[\da-z]{8}\$\@\1>$/i
meta		FORGED_MUA_MSO12_Message_ID		__CUST_X_Mailer_MSO12 && (!__MSO12_Message_ID || !(__MSO12_From_Message_ID1 || __MSO12_From_Message_ID2))
describe	FORGED_MUA_MSO12_Message_ID		Forged MUA Microsoft Office Outlook 12
score		FORGED_MUA_MSO12_Message_ID		2.5

meta		FORGED_MUA_MSO_boundary			__CUST_Content_Type_multipart && __CUST_X_Mailer_MSO && !__CUST_Content_Type_multipart_OE_boundary
describe	FORGED_MUA_MSO_boundary			Forged MUA Microsoft Office Outlook
score		FORGED_MUA_MSO_boundary			2.5