[Shared Samples] [PR #4505] modified rule: PR# 4505 - Credential phishing: Fake storage alerts (unsolicited)

Author: github-actions[bot]

detection-rules/4505_link_fake_storage_alert.yml

@@ -75,7 +75,7 @@ source: |
     or strings.icontains(subject.subject, "action required")
     or strings.icontains(subject.subject, "undelivered messages")
     or strings.icontains(subject.subject, "review storage")
-    or regex.icontains(subject.subject, "(?:upgrade|act) (?:today|now)")
+    or regex.icontains(subject.subject, '(?:upgrade|\bact\b) (?:today|now)')
     or strings.icontains(subject.subject, "subscription terminated")
     or regex.icontains(subject.subject,
                        'at (?:100|9[0-9](?:\.\d+)?|one[\s-]?hundred) ?(?:percent|%)'