Re: Help with rule against fake invoices (match name= attribute of Content-Type HDR)

Just off the top of my head, completely untested:

header _SUB_RECH    Subject    =~ /\b_SUB_RECH\b/
header _CT_IS_HTML    Content-Type    =~ 
/\bname=\"*{1,100}\.html\"\s{0,10}$/
meta    INV_MIME_HTML    _SUB_RECH && _CT_IS_HTML
describe    INV_MIME_HTML    Invoice with HTML attachment
score    INV_MIME_HTML    2

This doesn't check that the content is an attachment, but maybe will do what 
you want.
Checking it is an attachment takes a little more work, but is certainly 
possible.

        Loren