Update Fake Photo Share rule

detection-rules/spam_fake_photo_share.yml → detection-rules/spam_fake_photo.yml

@@ -1,4 +1,4 @@
-name: "Spam: Fake photo share"
+name: "Spam: Photo/image lure"
 description: 'Message contains pretexting language about sharing photos ("found these photos and thought you''d like them", "remember these photos?") and a link with a newly registered domain. Fake threads and plain text bodies have been seen in the wild, indicating active evasion techniques.'
 type: "rule"
 severity: "low"
@@ -66,14 +66,19 @@ source: |
         )
         or (
           length(body.current_thread.text) < 500
-          and strings.ilike(body.current_thread.text,
-                            "*picture*",
-                            "*photo*",
-                            "*image*",
-                            "*sad news*",
-                            "*sad announcement*",
-                            "*sad update*",
-                            "*new pics*"
+          and (
+            strings.ilike(body.current_thread.text,
+                          "*picture*",
+                          "*photo*",
+                          "*image*",
+                          "*sad news*",
+                          "*sad announcement*",
+                          "*sad update*",
+                          "*new pics*"
+            )
+            or regex.icontains(body.current_thread.text,
+                               '\b(photo|pics?|picture)\b'
+            )
           )
         )
       )