+score ZIPFILE 1.5
+
+header PI_NUM_WORD_SUBJ subject =~ /^\d+ [a-z0-9_-]+$/
+describe PI_NUM_WORD_SUBJ "number and single word subject"
+score PI_NUM_WORD_SUBJ 0.5
+
+header PI_NUM_ONLY_SUBJ subject =~ /^\d+$/
+describe PI_NUM_ONLY_SUBJ "number only subject"
+score PI_NUM_ONLY_SUBJ 0.5
+
+header PI_IMPORTANCE_HIGH importance =~ /^high$/
+describe PI_IMPORTANCE_HIGH "importance: high header"
+score PI_IMPORTANCE_HIGH 0.5
+
+meta PI_ZIPFILE_NUM_WORD_SUBJ PI_NUM_WORD_SUBJ && ZIPFILE
+describe PI_ZIPFILE_NUM_WORD_SUBJ "common spam/virus pattern"
+score PI_ZIPFILE_NUM_WORD_SUBJ 3
+
+meta PI_ZIPFILE_NUM_ONLY_SUBJ PI_NUM_ONLY_SUBJ && ZIPFILE
+describe PI_ZIPFILE_NUM_ONLY_SUBJ "common spam/virus pattern"
+score PI_ZIPFILE_NUM_ONLY_SUBJ 3
+
+full DOCFILE /\b(?:file)?name\=.*\.doc\b/i
+describe DOCFILE doc attachment
+score DOCFILE 3