SwiftFilter/Quarantine-Subject.txt at master · SwiftOnSecurity/SwiftFilter · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
== SWIFTFILTER HEADER - BEGIN ==

Name: QuaratineSpam-Subject
Description: Virtually no false-positives, but quickly goes out of date

Rules:
- Subject includes any of these words: <SET0>

Exceptions:
- if sender's address includes:
--- facebook

- if sender's domain is:
--- docusign.net
--- quarantine.messaging.microsoft.com

Actions:
- Deliver to quarantine
- Send an incident report to monitoring mailbox

== SWIFTFILTER HEADER - END ==

== SET0 - BEGIN <TEXT> ==

- name unavailable
.com Document is Ready for Signature
account Has Been Limited
ACTION REQUIRED: Completed: Docusign
Attached File to Docusign
Banking is temporarily unavailable
bankofamerica
Closing Statement Invoice Payment For PO
Delivery stopped for shipment
detected suspicious
detected suspicious actvity
docu sign
document for you
document has been sent to you via Docusign
FreeFax
Fwd: Due invoice paid
REQUIRED: Completed Docusign
RingCentral
secured files
secured pdf
Unrecognized login attempt,
You have notifications pending
Your document Settlement
Your password has been compromised

== SET0 - END <TEXT> ==