[Test Rules] [PR #4592] modified rule: Spam: Fake photo share

Author: github-actions[bot]

detection-rules/4592_spam_fake_photo_share.yml

@@ -137,8 +137,10 @@ source: |
               and .href_url.domain.root_domain in ("facebook.com", "youtube.com")
             )
             or (
-              // short random subdomain
-              regex.icontains(.href_url.url, 'https?://[a-z]{5}\.[a-z]+\.')
+              // random 5-character subdomain
+              regex.icontains(.href_url.url,
+                              'https?://[a-z]{5}\.[a-z]{5,}\.[a-z]+'
+              )
               // subdomain contains 3+ consecutive consonants
               and regex.icontains(.href_url.url,
                                   'https?://[a-z]*[b-df-hj-np-tv-z]{3,}[a-z]*\.'
@@ -191,4 +193,4 @@ detection_methods:
 id: "42b07278-999f-50e7-b96f-1bee369009c0"
 og_id: "eb086f7d-3ad7-52cd-8e16-3ce08726b9ea"
 testing_pr: 4592
-testing_sha: 58e307902b4f8fb275e78ca4aa44eb6829d8ce65
+testing_sha: 16f263c20058ea3d7f7d1d22289314eed12b1f2f