Skip to content

Commit

Permalink
Update qr_code_suspicious_indicators.yml (#925)
Browse files Browse the repository at this point in the history
  • Loading branch information
morriscode authored Nov 6, 2023
1 parent a3b082a commit 57e0036
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion detection-rules/qr_code_suspicious_indicators.yml
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@ source: |
.scan.qr.type is not null
// exclude images taken with mobile cameras and screenshots from android
and not any(.scan.exiftool.fields,
.key == "Model" or .key == "Megapixels"
.key == "Model"
or .key == "Software" and strings.starts_with(.value, "Android")
)
)
Expand Down

0 comments on commit 57e0036

Please sign in to comment.