Update body_callback_phishing_no_attachment.yml (#745)

sublime-security · Aug 30, 2023 · 0d700e3 · 0d700e3
1 parent 2f3c462
commit 0d700e3
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/detection-rules/body_callback_phishing_no_attachment.yml b/detection-rules/body_callback_phishing_no_attachment.yml
@@ -29,6 +29,7 @@ source: |
                     "*best buy*",
                     "*lifelock*"
   )
+  and length(body.current_thread.text) < 1500
   and 3 of (
     strings.ilike(body.current_thread.text, '*purchase*'),
     strings.ilike(body.current_thread.text, '*payment*'),
@@ -46,7 +47,7 @@ source: |
     strings.ilike(body.current_thread.text, '*refund*')
   )
   // phone number regex
-  and regex.icontains(body.current_thread.text, '\+?(\d{1}.)?\d{3}.\d{3,}')
+  and regex.icontains(body.current_thread.text, '\+?(\d{1}.)?\(?\d{3}?\)?.\d{3}.?\d{4}')
   and sender.email.domain.root_domain not in (
     // paypal domain
     "xoom.com"