diff --git a/detection-rules/qr_code_suspicious_indicators.yml b/detection-rules/qr_code_suspicious_indicators.yml index 6858d8b7b23..0700db03c02 100644 --- a/detection-rules/qr_code_suspicious_indicators.yml +++ b/detection-rules/qr_code_suspicious_indicators.yml @@ -14,7 +14,7 @@ source: | .scan.qr.type is not null // exclude images taken with mobile cameras and screenshots from android and not any(.scan.exiftool.fields, - .key == "Model" or .key == "Megapixels" + .key == "Model" or .key == "Software" and strings.starts_with(.value, "Android") ) )