diff --git a/detection-rules/body_bec_mobile_solicitation_reply_thread.yml b/detection-rules/body_bec_mobile_solicitation_reply_thread.yml index 0ec30a25b3e..5736dd82787 100644 --- a/detection-rules/body_bec_mobile_solicitation_reply_thread.yml +++ b/detection-rules/body_bec_mobile_solicitation_reply_thread.yml @@ -22,7 +22,7 @@ source: | ) ) and regex.icontains(.text, - '(?:mobile|suitable|contact|current|cell|call|another).{0,10}(phone|number|#|\bno)|whatsapp|\bcell|personalcell|(?:reliable|recent).{0,30}(?:phone|number).{0,15}contact' + '(?:mobile|suitable|contact|current|cell|call|another).{0,10}(phone|number|#|\bno)|whatsapp|\bcell|personalcell|(?:reliable|recent).{0,30}(?:phone|number).{0,15}contact|(?:share|send).{0,20}number.{0,10}(?:text|sms|whatsapp|reach\syou[\s,.\?](?:by|whether|when|for))' ) )