Update link_deactivated_bitly.yml (#998)

sublime-security · Nov 21, 2023 · 1196da9 · 1196da9
1 parent 8b51eb9
commit 1196da9
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/detection-rules/link_deactivated_bitly.yml b/detection-rules/link_deactivated_bitly.yml
@@ -11,7 +11,7 @@ source: |
           // link doesn't forward through
           and beta.linkanalysis(.).effective_url.domain.domain == "bit.ly"
           // blocked or gated by bit.ly
-          and strings.ilike(beta.linkanalysis(.).final_dom.display_text, "*link*blocked*", "*flagged*by*")
+          and strings.ilike(beta.linkanalysis(.).final_dom.display_text, "*link*blocked*", "*flagged*by*", "*been*deactivated*")
   )
 attack_types:
   - "Credential Phishing"