Update attachment_docusign_suspicious_links.yml (#2091)

sublime-security · Nov 13, 2024 · 67ce2c8 · 67ce2c8
1 parent 4d363bb
commit 67ce2c8
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/detection-rules/attachment_docusign_suspicious_links.yml b/detection-rules/attachment_docusign_suspicious_links.yml
@@ -43,7 +43,7 @@ source: |
                    or (
                      regex.icontains(.scan.ocr.raw,
                                      "((re)?view|access|complete(d)?) document(s)?",
-                                     "[^d][^o][^cd][^ue]sign",
+                                     '[^d][^o][^cd][^ue]sign(?:\b|ature)',
                                      "important edocs",
                                      // German (Document (check|check|sign|sent))
                                      "Dokument (überprüfen|prüfen|unterschreiben|geschickt)",