Merge branch 'main' into sam.fp.credphish.otherindicators

sublime-security · Sep 18, 2023 · 855c918 · 855c918
2 parents c77b714 + fd061d1
commit 855c918
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/detection-rules/link_qr_code_suspicious_language_fts.yml b/detection-rules/link_qr_code_suspicious_language_fts.yml
@@ -11,7 +11,7 @@ source: |
   // check image attachments for QR code, will want to add message.screenshot functionality here when it's ready
   // and length(attachments) < 10
   and any(attachments,
-          .file_type in $file_types_images
+          (.file_type in $file_types_images or .file_type == "pdf")
           and any(file.explode(.),
                   .scan.qr.type == "url"