From 964ca0c32ed7455239f6218f3a89e0578b99be35 Mon Sep 17 00:00:00 2001
From: shadow-helix <96267549+shadow-helix@users.noreply.github.com>
Date: Thu, 19 Dec 2024 13:42:05 +0000
Subject: [PATCH] Update decode-spam-headers.py

Added dest:C and dest:D as possible options within X-Microsoft-Antispam-Mailbox-Delivery header
---
 decode-spam-headers.py | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/decode-spam-headers.py b/decode-spam-headers.py
index ff0c538..5152736 100644
--- a/decode-spam-headers.py
+++ b/decode-spam-headers.py
@@ -5801,8 +5801,13 @@ Src: https://www.cisco.com/c/en/us/td/docs/security/esa/esa11-1/user_guide/b_ESA
             if k not in parsed.keys():
                 parsed[k.lower()] = v
 
-        if 'ucf' in parsed.keys() and 'dest' in parsed.keys() and parsed['ucf'] == '1' and parsed['dest'] == 'J':
-            result += self.logger.colored(f'- WARNING: User created a custom mail rule that moved this message to JUNK folder!\n', "red")
+        if 'ucf' in parsed.keys() and 'dest' in parsed.keys() and parsed['ucf'] == '1':
+            if parsed['dest'] == 'J':
+                result += self.logger.colored(f'- WARNING: User created a custom mail rule that moved this message to JUNK folder!\n', "red")
+            elif parsed['dest'] == 'D':
+                result += self.logger.colored(f'- WARNING: User created a custom mail rule that moved this message to DELETED ITEMS folder!\n', "red")
+            elif parsed['dest'] == 'C':
+                result += self.logger.colored(f'- WARNING: User created a custom mail rule that moved this message to a custom (non built-in) folder!\n', "red")
 
         for k, v in parsed.items():
             elem = None