Update body_extortion.yml (#2125)

sublime-security · Nov 14, 2024 · 4db6fa2 · 4db6fa2
1 parent 8ee9d47
commit 4db6fa2
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/detection-rules/body_extortion.yml b/detection-rules/body_extortion.yml
@@ -26,10 +26,10 @@ source: |
       ),
       regex.icontains(body.current_thread.text, "pervert|perversion|masturbat"),
       // a timeframe to pay
-      regex.icontains(body.current_thread.text, '\d\d hours', '(?:one|two|three) days?'),
+      regex.icontains(body.current_thread.text, '\d\d hours', '(?:one|two|three|\d) days?'),
       // a promise from the actor
       regex.icontains(body.current_thread.text,
-                        'permanently delete|destroy (?:\w+\s*){0,4} (?:data|evidence|videos?)'
+                        'permanently delete|(remove|destroy) (?:\w+\s*){0,4} (?:data|evidence|videos?)'
       ),
       // a threat from the actor
       regex.icontains(body.current_thread.text,