[Shared Samples] [PR #4317] modified rule: PR# 4317 - Body: Fake conversation with spouse mention and video call request

Author: github-actions[bot]

detection-rules/4317_body_spouse_fake_call.yml

@@ -5,49 +5,17 @@ severity: "medium"
 source: |
   type.inbound
   and length(body.previous_threads) >= 3
-  and (
-    (
-      (
-        strings.icontains(body.previous_threads[length(body.previous_threads) - 2].text,
-                          "wife and i"
-        )
-        or strings.icontains(body.previous_threads[length(body.previous_threads) - 2].text,
-                             "husband and i"
-        )
-      )
-      and strings.icontains(body.previous_threads[length(body.previous_threads) - 2].text,
-                            "call"
-      )
-      and (
-        strings.icontains(body.previous_threads[length(body.previous_threads) - 2].text,
-                          "zoom"
-        )
-        or strings.icontains(body.previous_threads[length(body.previous_threads) - 2].text,
-                             "google meet"
-        )
-      )
-    )
-    or (
-      (
-        strings.icontains(body.previous_threads[length(body.previous_threads) - 3].text,
-                          "wife and i"
-        )
-        or strings.icontains(body.previous_threads[length(body.previous_threads) - 3].text,
-                             "husband and i"
-        )
-      )
-      and strings.icontains(body.previous_threads[length(body.previous_threads) - 3].text,
-                            "call"
-      )
-      and (
-        strings.icontains(body.previous_threads[length(body.previous_threads) - 3].text,
-                          "zoom"
-        )
-        or strings.icontains(body.previous_threads[length(body.previous_threads) - 3].text,
-                             "google meet"
-        )
-      )
-    )
+  and any(body.previous_threads,
+          strings.icontains(.text, "call")
+          and (
+            strings.icontains(.text, "wife and i")
+            or strings.icontains(.text, "husband and i")
+          )
+          and (
+            (strings.icontains(.text, "zoom"))
+            or (strings.icontains(.text, "google meet"))
+          )
+          and length(.text) < 1400
   )
 
 attack_types: