Use attachments instead of message screenshot

sublime-security · Nov 9, 2023 · c0eea23 · c0eea23
1 parent b6293df
commit c0eea23
Showing 1 changed file with 6 additions and 2 deletions.
diff --git a/detection-rules/link_credential_phishing_intent_and_other_indicators.yml b/detection-rules/link_credential_phishing_intent_and_other_indicators.yml
@@ -304,10 +304,14 @@ source: |
         )
       ),
       // in case it's embedded in an image attachment
-      any(file.explode(beta.message_screenshot()),
-              any(ml.nlu_classifier(.scan.ocr.raw).intents,
+      // note: don't use message_screenshot() because it's not limited to current_thread
+      // and may FP
+      any(attachments, .file_type in $file_types_images
+          and any(file.explode(.),
+          any(ml.nlu_classifier(.scan.ocr.raw).intents,
                   .name == "cred_theft" and .confidence == "high"
               )
+          )
       )
     )
     or (