From 9d806145e0aabfd9b1087e062fa30707d2842e1b Mon Sep 17 00:00:00 2001 From: Cameron Dunn Date: Wed, 27 Dec 2023 11:21:41 -0800 Subject: [PATCH] Update detection-rules/attachment_adobe_image_lure_qr_code.yml --- detection-rules/attachment_adobe_image_lure_qr_code.yml | 1 - 1 file changed, 1 deletion(-) diff --git a/detection-rules/attachment_adobe_image_lure_qr_code.yml b/detection-rules/attachment_adobe_image_lure_qr_code.yml index 2b1814291d7..a8240b5f819 100644 --- a/detection-rules/attachment_adobe_image_lure_qr_code.yml +++ b/detection-rules/attachment_adobe_image_lure_qr_code.yml @@ -22,7 +22,6 @@ source: | or .file_type == "pdf" or .file_type in $file_extensions_macros ) - and ( any(file.explode(.), regex.icontains(.scan.ocr.raw, 'scan|camera')