[Rspamd-Users] Subject rewrite on Clamav detection

[usenet at schani.com]

Hello,
i get a lot of clamav detection like

Tue Apr 18 17:01:17 2023 -> instream(local): 
Heuristics.Phishing.Email.SpoofedDomain FOUND
Tue Apr 18 17:01:28 2023 -> instream(local): 
Heuristics.Phishing.Email.SpoofedDomain FOUND
Tue Apr 18 17:01:55 2023 -> instream(local): 
Heuristics.Phishing.Email.SpoofedDomain FOUND
Tue Apr 18 17:02:06 2023 -> instream(local): 
Heuristics.Phishing.Email.SpoofedDomain FOUND
Tue Apr 18 17:02:28 2023 -> instream(local): 
Heuristics.Phishing.Email.SpoofedDomain FOUND

Of course, these emails are recognized as spam and end up in the spam 
folder with the ***SPAM*** subject.
Is it possible to add the note Phishing.Email.SpoofedDomain?

E.g.: ***SPAM*** [Phishing.Email.SpoofedDomain] the subject of the email 
....

How can I do this in rspamd?
Thanks