From dee9b81648f6a86f42979200fa68c34bf2617897 Mon Sep 17 00:00:00 2001 From: Sam Scholten Date: Fri, 20 Oct 2023 10:24:47 -0400 Subject: [PATCH] Update callback_phishing_nlu_body_or_attachments.yml (#871) --- detection-rules/callback_phishing_nlu_body_or_attachments.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/detection-rules/callback_phishing_nlu_body_or_attachments.yml b/detection-rules/callback_phishing_nlu_body_or_attachments.yml index b5b1f1a0c7f..019994e3efc 100644 --- a/detection-rules/callback_phishing_nlu_body_or_attachments.yml +++ b/detection-rules/callback_phishing_nlu_body_or_attachments.yml @@ -5,6 +5,7 @@ type: "rule" severity: "medium" source: | type.inbound + and length(attachments) < 5 and ( any(attachments, (.file_type in $file_types_images or .file_type == "pdf")