Update attachment_callback_phish_with_pdf.yml (#2237)

sublime-security · Dec 19, 2024 · bd3af67 · bd3af67
1 parent 50dc514
commit bd3af67
Showing 1 changed file with 4 additions and 0 deletions.
diff --git a/detection-rules/attachment_callback_phish_with_pdf.yml b/detection-rules/attachment_callback_phish_with_pdf.yml
@@ -74,6 +74,10 @@ source: |
                     strings.icontains(.scan.ocr.raw, "norton"),
                     strings.icontains(.scan.ocr.raw, "ebay"),
                     strings.icontains(.scan.ocr.raw, "paypal"),
+                    // suspicious attachment name
+                    (
+                      regex.icontains(.file_name, 'INV(?:_|\s)?\d+(.pdf)$')
+                    )
                   )
                   // Negate bank statements
                   and not (