header ANTIGEN subject=~/Antigen Notification/
describe ANTIGEN Antigen Notification
score ANTIGEN 4
+
+# cord 2010-05-04
+body AUTOMATIC_MESSAGE /This is an automat(ic|ed) message/i
+describe AUTOMATIC_MESSAGE body indicates it is an automated message
+score AUTOMATIC_MESSAGE 2.0
+
+# formorer 2012-02-15
+header XEROX subject=~/Scan from a Xerox W./i
+describe XEROX Scanner malware
+score XEROX 4
+