From a6edb6a8bb27fe836099659b1fa75ed0f49fc032 Mon Sep 17 00:00:00 2001 From: Sam Scholten Date: Tue, 7 Jan 2025 18:58:45 -0500 Subject: [PATCH] Update link_fake_storage_alert.yml --- detection-rules/link_fake_storage_alert.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/detection-rules/link_fake_storage_alert.yml b/detection-rules/link_fake_storage_alert.yml index 0defd73a69b..8dc140ecbd1 100644 --- a/detection-rules/link_fake_storage_alert.yml +++ b/detection-rules/link_fake_storage_alert.yml @@ -64,6 +64,7 @@ source: | or strings.icontains(subject.subject, "compliance") or strings.icontains(subject.subject, "max storage") or strings.icontains(subject.subject, "storage space") + or strings.icontains(subject.subject, "be deleted") ) // netgate links to loopnet.com - a popular commerical property listing service and not (