Update callback_phishing_nlu_body_or_attachments.yml

sublime-security · Oct 23, 2023 · 3279120 · 3279120
1 parent dee9b81
commit 3279120
Showing 1 changed file with 7 additions and 2 deletions.
diff --git a/detection-rules/callback_phishing_nlu_body_or_attachments.yml b/detection-rules/callback_phishing_nlu_body_or_attachments.yml
@@ -10,8 +10,13 @@ source: |
     any(attachments,
         (.file_type in $file_types_images or .file_type == "pdf")
         and any(file.explode(.),
-                any(ml.nlu_classifier(.scan.ocr.raw).intents,
-                    .name == "callback_scam" and .confidence == "high"
+
+                // exclude images taken with mobile cameras
+                not any(.scan.exiftool.fields,
+                        .key == "Model" and strings.istarts_with(.value, "Iphone")
+                )
+                and any(ml.nlu_classifier(.scan.ocr.raw).intents,
+                        .name == "callback_scam" and .confidence == "high"
                 )
         )
     )