It's working now.  Thanks Jim!

Edit: To clarify, the expression filter Subject: [[]Spam]* works.  

I  have seen some mail coming in as replies to messages sent by my users that got tagged as spam ('[SPAM]' added to the subject line) by the recipient but they left the spam tag in the subject line.  My mail host uses spamassassin to do the same thing which I filter on using a header filter that looks for [SPAM] in the subject header.  Obviously these replies are getting filtered so I attempted a workaround that failed and I need help figuring out why.  I replaced the header filter with an expression filter that detected: Subject: [SPAM]*.  It failed to detect any [SPAM] tagged messages.  I double checked for typos and spacing but no joy.  A look at the manual shows the bracket symbols as defining a set of characters so before I load the users mailboxes with spam again I thought I would ask for some help.  I am thinking this should work: Subject: [[]SPAM[]]*.  Thoughts please.

I'm pretty sure that is correct.   You have to use [[] to make it recognize [

All metacharacters can be used as many times as necessary. Regular

expression searches always start in case-insensitive mode.

To search for

literal occurrences of any of the characters *, ?, + or [, you must

enclose them in group markers
so to search for a literal asterisk,

enter [*]

 
     *    Match any number of any characters
     ?    Match any single characters
     +    Match one or more occurrence of the last character matched
     [  ]    Encloses a set of characters that will match. Ranges can be specified in the set using "-"
     /w    Match zero or more whitespace characters (spaces, end-of-line markers and tabs)
     /W    Match one or more whitespace characters (spaces, end-of-line markers and tabs)
     /c    Toggle case-sensitivity mid-expression (matching is case-insensitive by default)
     /s    Toggle whitespace stripping - ignore whitespace altogether when matching
     /b    Match a start-of-word boundary (including start-of-line)
     /B    Match an end-of-word boundary (including end-of-line)
     /x    Toggle "ignore-non-alpha" mode - ignore non-alphanumeric characters
     /X    Toggle "ignore-spam" mode - ignore non-alphanumeric characters except @ and |

All metacharacters can be used as many times as necessary. Regular expression searches always start in case-insensitive mode. To search for literal occurrences of any of the characters *, ?, + or [, you must enclose them in group markers (so to search for a literal asterisk, enter [*]). Regular expressions do not cross line boundaries - you can only perform expression matching within individual lines in the message.