diff --git a/detection-rules/body_bec_mobile_solicitation_reply_thread.yml b/detection-rules/body_bec_mobile_solicitation_reply_thread.yml index 2e246619bef..ac85a112cac 100644 --- a/detection-rules/body_bec_mobile_solicitation_reply_thread.yml +++ b/detection-rules/body_bec_mobile_solicitation_reply_thread.yml @@ -22,7 +22,7 @@ source: | ) ) and regex.icontains(.text, - '(?:mobile|suitable|contact|current|cell|call|another).{0,10}(?:phone|number|#|\bno)|personal\s?(?:phone|cell|number|#)|whatsapp|\bcell|personalcell|(?:reliable|recent).{0,30}(?:phone|number).{0,15}contact|(?:share|send|confirm).{0,20}number.{0,25}(?:text|sms|whatsapp|contact|reach\syou[\s,.\?](?:by|whether|when|for))|best\s+(?:number|#).{0,10}(?:text|sms|contact|call|message|in[-\s]?touch|to\suse)|best\s+way.{0,25}(?:reach|contact).{0,25}(?:text|sms|whatsapp|call|message)' + '(?:mobile|suitable|contact|current|cell|call|another).{0,10}(?:phone|number|#|\bno)|personal\s?(?:phone|cell|number|#)|whatsapp|\bcell|personalcell|(?:reliable|recent).{0,30}(?:phone|number|#).{0,15}(?:contact|reach)|(?:share|send|confirm).{0,20}number.{0,25}(?:text|sms|whatsapp|contact|reach\syou[\s,.\?](?:by|whether|when|for))|best\s+(?:number|#).{0,10}(?:text|sms|contact|call|message|in[-\s]?touch|to\suse)|(?:best|fastest)\s+way.{0,25}(?:reach|contact|get\s+in\s+touch).{0,25}(?:text|sms|whatsapp|call|message)' ) )