Update attachment_pdf_comp_review.yml

alexo-nano · web-flow · commit baf421bdd210 · 2025-12-05T17:53:32.000-05:00
Added to the regex.icontains phrase list querying file explode.strings.
diff --git a/detection-rules/attachment_pdf_comp_review.yml b/detection-rules/attachment_pdf_comp_review.yml
@@ -61,7 +61,7 @@ source: |
                 any([.scan.strings.raw, .scan.ocr.raw],
                     (
                       regex.icontains(.,
-                                      '\b(?:Remuneration Overview|Updated Compensation (?:Summary|Schedule|Details)|Access Your Statements?|Staff Performance Appraisal|Compensation Adjustment|performance appraisal|Appraisal Overview|appraisal and compensation|salary increment)\b'
+                                      '\b(?:Remuneration Overview|Updated Compensation (?:Summary|Schedule|Details)|Access Your Statements?|Staff Performance Appraisal|Compensation Adjustment|performance appraisal|Appraisal Overview|appraisal and compensation|salary (increment|deduction))\b'
                       )
                     )
                 )

Original file line number	Diff line number	Diff line change
`@@ -61,7 +61,7 @@ source: \|`
`61`	`61`	`any([.scan.strings.raw, .scan.ocr.raw],`
`62`	`62`	`(`
`63`	`63`	`regex.icontains(.,`
`64`		`- '\b(?:Remuneration Overview\|Updated Compensation (?:Summary\|Schedule\|Details)\|Access Your Statements?\|Staff Performance Appraisal\|Compensation Adjustment\|performance appraisal\|Appraisal Overview\|appraisal and compensation\|salary increment)\b'`
	`64`	`+ '\b(?:Remuneration Overview\|Updated Compensation (?:Summary\|Schedule\|Details)\|Access Your Statements?\|Staff Performance Appraisal\|Compensation Adjustment\|performance appraisal\|Appraisal Overview\|appraisal and compensation\|salary (increment\|deduction))\b'`
`65`	`65`	`)`
`66`	`66`	`)`
`67`	`67`	`)`