From 90ee2476c26748fc8ce3cebc944edd73a32368dd Mon Sep 17 00:00:00 2001 From: Sam Scholten Date: Tue, 26 Sep 2023 10:02:37 -0400 Subject: [PATCH] Update detection-rules/attachment_microsoft_image_lure_qr_code.yml Co-authored-by: Ross Wolf <31489089+rw-access@users.noreply.github.com> --- detection-rules/attachment_microsoft_image_lure_qr_code.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detection-rules/attachment_microsoft_image_lure_qr_code.yml b/detection-rules/attachment_microsoft_image_lure_qr_code.yml index e9af7b45b62..d2cf026797e 100644 --- a/detection-rules/attachment_microsoft_image_lure_qr_code.yml +++ b/detection-rules/attachment_microsoft_image_lure_qr_code.yml @@ -38,7 +38,7 @@ source: | ) // or the body is null - or length(body.current_thread.text) is null + or body.current_thread.text is null or body.current_thread.text == "" // or the subject contains authentication/urgency verbiage