Update callback_phishing_nlu_body_or_attachments.yml (#871)

sublime-security · Oct 20, 2023 · dee9b81 · dee9b81
1 parent b69fef6
commit dee9b81
Showing 1 changed file with 1 addition and 0 deletions.
diff --git a/detection-rules/callback_phishing_nlu_body_or_attachments.yml b/detection-rules/callback_phishing_nlu_body_or_attachments.yml
@@ -5,6 +5,7 @@ type: "rule"
 severity: "medium"
 source: |
   type.inbound
+  and length(attachments) < 5
   and (
     any(attachments,
         (.file_type in $file_types_images or .file_type == "pdf")