[Test Rules] [PR #4374] modified rule: Business Email Compromise: Request for mobile number via reply thread hijacking

Author: github-actions[bot]

detection-rules/4374_body_bec_mobile_solicitation_reply_thread.yml

@@ -22,7 +22,7 @@ source: |
             )
           )
           and regex.icontains(.text,
-                              '(?:mobile|suitable|contact|current|cell|call|another).{0,10}(phone|number|#|\bno)|whatsapp|\bcell|personalcell|(?:reliable|recent).{0,30}(?:phone|number).{0,15}contact|(?:share|send).{0,10}(?:a\s)?number.{0,10}(?:text|reach)'
+                              '(?:mobile|suitable|contact|current|cell|call|another).{0,10}(phone|number|#|\bno)|whatsapp|\bcell|personalcell|(?:reliable|recent).{0,30}(?:phone|number).{0,15}contact|(?:share|send).{0,20}number.{0,10}(?:text|sms|whatsapp|reach\syou[\s,.\?](?:by|whether|when|for))'
           )
   )
   
@@ -79,4 +79,4 @@ detection_methods:
 id: "2e916bfc-66ee-5047-b15a-ee4c8b04591c"
 og_id: "0282f346-7175-5d9c-9b10-a3e99462d263"
 testing_pr: 4374
-testing_sha: 9af7c1ce8cc56ebfcbc89854c269d8d58d857728
+testing_sha: 03e544358dfb47f01571b2551108da5b27914445