Updating Rule: link_qr_code_suspicious_language_fts.yml (#792)

sublime-security · Sep 14, 2023 · fd061d1 · fd061d1
1 parent dec1558
commit fd061d1
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/detection-rules/link_qr_code_suspicious_language_fts.yml b/detection-rules/link_qr_code_suspicious_language_fts.yml
@@ -11,7 +11,7 @@ source: |
   // check image attachments for QR code, will want to add message.screenshot functionality here when it's ready
   // and length(attachments) < 10
   and any(attachments,
-          .file_type in $file_types_images
+          (.file_type in $file_types_images or .file_type == "pdf")
           and any(file.explode(.),
                   .scan.qr.type == "url"