Let's say you want to give emails sent to "hello your_domain_name" such as "hello example.com" to be flagged as spam.

In /etc/mail/spamassassin/local.cf you could add the following rules.

body            MY_RULE         /(hi|hello|dear).*example\.com/i
describe        MY_RULE         probably sent from a spammer
score           MY_RULE         5.0

Restart SpamAssassin and the SpamAssassin Milter for this change to take effect.

systemctl restart spamassassin
systemctl restart spamass-milter

Send a test email with something like "dear example.com" in the body and ensure /var/log/maillog identifies the email as spam.

Mar  3 22:46:14 ip-172-31-19-227 spamd[987]: spamd: identified spam (5.0/5.0) for sa-milt:992 in 0.4 seconds, 2104 bytes.
Mar  3 22:46:14 ip-172-31-19-227 spamd[987]: spamd: result: Y 5 - MY_RULE scantime=0.4,size=2104,user=sa-milt,uid=992,required_score=5.0,rhost=::1,raddr=::1,rport=37236,mid=<c4a892c4bde2be502e1f326b1df338767e482390@webmail>,autolearn=no autolearn_force=no