[Test Rules] [PR sublime-security#4579] modified rule: Attachment: PDF Attachment with links to workers.dev

Author: github-actions[bot]

detection-rules/4579_attachment_pdf_workersdev.yml

@@ -5,12 +5,11 @@ severity: "medium"
 source: |
   type.inbound
   and any(filter(attachments, .file_type == "pdf"),
-          beta.parse_exif(.).page_count < 5
+          beta.parse_exif(.).page_count <= 2
           and any(file.explode(.),
                   any(.scan.url.urls, .domain.root_domain == "workers.dev")
           )
   )
-  
 attack_types:
   - "Credential Phishing"
 tactics_and_techniques:
@@ -24,4 +23,4 @@ detection_methods:
 id: "0a6801b4-63c5-5662-91de-b797c0f396a3"
 og_id: "e8be2515-8b3d-5222-80da-6ecfad58341a"
 testing_pr: 4579
-testing_sha: 06a2e456d8c09b148eb7076205280ec13eca01ce
+testing_sha: ae169673e9f80695dc566cb5ca88a609f234ca65