dave koontz fcquqwdmbcedu thanks info uri check much better joseph absolutely correct catching wide modified pattern check end works treat uri dangerous_url exescrpifcmdbatvbswshi describe dangerous_url url contains executable content score dangerous_url 75 joseph brennan wrote saturday february 23 2008 2308 0500 dave koontz wrote still getting storm worm messages caught even sane security clamav thought id write rule score url dot exe scr pif extension however rule working someone help advise wrong want pickup http https extensions body dangerous_url http1200exescrpifi uri dangerous_url http1200exescrpifi think body excludes html code could use rawbody normally one uses uri get links importantly need dot 1200 original matches 1 200 p characters loren wilton suggested leaving http1200 note would match things like wwwscratchytld unless narrow mimedefang good matching bad file extensions feel like adding system thu 07 aug 2008 193046 0500 please help rule