IPS custom signature to filter email domain

[mcat84]

Using IPS 5.0.

I'm creating custom signature on SMTP using State Name: SMTP Commands.

My question:

1. On the Regex String, what should i key in to disable any users from the sex.com domain to send me email. I have keyin

[Mm][Aa][Ii][Li][\t][Ff][Rr][Oo][Mm]:^.@[Ss][Ee][Xx].[Cc][Oo][Mm]

but i don't think this is corrent...am i ??

2. In the State Name(SMTP), they have

Abort, Mail Body, Mail Header, SMTP Commands and Start. Can anyone provide the information (URL) and example of how to use these....

Thanks in advance...

[craiwill]

The documentation for 5.1 is located at:

http://www.cisco.com/en/US/customer/products/hw/vpndevc/ps4077/products_configuration_guide_book09186a008055de07.html

I believe the regex you want is:

[Mm][Aa][Ii][Ll][\t][Ff][Rr][Oo][Mm][:][\x21-\x7E]+[@][Ss][Ee][Xx].[Cc][Oo][Mm]

The + field allows for any printable characters (but there must be at least 1) in the senders email address. You should use the SMTP state machine with the SMTP Commands state set, direction to service port 25.