Update attachment_callback_phish_with_pdf.yml (#927)

sublime-security · Nov 7, 2023 · b60798a · b60798a
1 parent 92a3cb4
commit b60798a
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/detection-rules/attachment_callback_phish_with_pdf.yml b/detection-rules/attachment_callback_phish_with_pdf.yml
@@ -45,7 +45,7 @@ source: |
                     strings.icontains(.scan.ocr.raw, "cancel"),
                     strings.icontains(.scan.ocr.raw, "renew"),
                     strings.icontains(.scan.ocr.raw, "refund"),
-                    regex.icontains(.scan.ocr.raw, '\+\d')
+                    regex.icontains(.scan.ocr.raw, '(\+\d|1.(\()?\d{3}(\))?\D\d{3}\D\d{4})')
                   )
           )