+# blarson 2010-01-28
+header FROMWWW from =~ /\bwww\./i
+describe FROMWWW from www.whatever
+score FROMWWW 3
+
+# blarson 2010-02-16
+header FROMCASINO from =~ /\bcasino/i
+describe FROMCASINO from casino
+score FROMCASINO 3
+
+# don 2010-06-10
+header CTOCTET_STREAM ContentType =~ /octet-stream/i
+describe CTOCTET_STREAM Content type is octet-stream
+score CTOCTET_STREAM 0.5
+
+header RTF_ATTACH ContentType =~ /name=.+\.rtf/i
+describe RTF_ATTACH Contains an RTF Attachment
+score RTF_ATTACH 0.5
+
+meta RTF_SPAM CTOCTET_STREAM & RTF_ATTACH
+describe RTF_SPAM Content type is octet-stream and has an RTF Attachment
+score RTF_SPAM 3
\ No newline at end of file