EmailDiscussions.com - View Single Post

BritTim · 8 Jun 2017, 08:48 PM

I do not have time to test, but I think you need something like

Code:

body :raw :regex "filename=.+\\.pdf"

Since there is no header that contains information about attachments, you need to search the message body for the incantation that identifies them. Based on experience with this kind of test, be prepared for the occasional false positive.

8 Jun 2017, 08:48 PM	#3
BritTim The "e" in e-mail Join Date: May 2003 Location: mostly in Thailand Posts: 3,095	I do not have time to test, but I think you need something like Code: body :raw :regex "filename=.+\\.pdf" Since there is no header that contains information about attachments, you need to search the message body for the incantation that identifies them. Based on experience with this kind of test, be prepared for the occasional false positive.