Update impersonation_netflix.yml

sublime-security · Sep 8, 2023 · 574b4f4 · 574b4f4
1 parent 3e746a3
commit 574b4f4
Showing 1 changed file with 8 additions and 6 deletions.
diff --git a/detection-rules/impersonation_netflix.yml b/detection-rules/impersonation_netflix.yml
@@ -21,12 +21,14 @@ source: |
           .href_url.domain.tld not in ("com", "org", "net", "ms") and .href_url.domain.valid == true
       )
     )
-    or 2 of (
-      strings.icontains(body.current_thread.text, "restart"),
-      strings.icontains(body.current_thread.text, "cancelled"),
-      strings.icontains(body.current_thread.text, "membership"),
-      strings.icontains(body.current_thread.text, "expir"),
-      strings.icontains(body.current_thread.text, "payment")
+    or (
+      2 of (
+        strings.icontains(body.current_thread.text, "restart"),
+        strings.icontains(body.current_thread.text, "cancelled"),
+        strings.icontains(body.current_thread.text, "membership"),
+        strings.icontains(body.current_thread.text, "expir"),
+        strings.icontains(body.current_thread.text, "payment")
+      )
       and length(body.links) > 0
       and not any(body.links,
                   .href_url.domain.root_domain in ("netflix.com", "dvd.com", "netflixfamily.com")