[BlueOnyx:26363] AV-Spam rule expression

[Chris Gebhardt - VIRTBIZ Internet]

We're using AV-SPAM across our hosting servers with good results.   
However, one that seems to be squeaking through with regularity is the 
"I RECORDED YOU" scam, where you're directed to send money to an 
individual who has purportedly hacked your webcam to catch you in (ahem) 
compromised states of exposure.   In some cases, users are getting 
flooded with dozens per hour from various sources, various sending email 
addresses, but the subject always remains the same.

It seems that it would be beneficial to create a custom SpamAssassin 
rule via the GUI to flag messages with this subject and issue them a 
high spam score.

My question is in the expression, should I be using the subject as it 
appears (I RECORDED YOU) or should I be attempting regex (I\sRECORDED\sYOU)?

Thanks for any advice.   (Also, I'm terrible with regex).

-- 
Chris Gebhardt
VIRTBIZ Internet Services
Access, Web Hosting, Colocation, Dedicated
www.virtbiz.com | toll-free (866) 4 VIRTBIZ