Update link_multistage_landing_jotform.yml (#3588)

zoomequipd · web-flow · commit 50b6bcbbea48 · 2025-12-01T22:13:10.000Z
diff --git a/detection-rules/link_multistage_landing_jotform.yml b/detection-rules/link_multistage_landing_jotform.yml
@@ -19,7 +19,7 @@ source: |
           )
           // it contains suspicious elements within the extracted "appInfo"
           or any(regex.iextract(ml.link_analysis(.).final_dom.raw,
-                                'window\.__appInfo = (?P<appInfo>\{[^\;]+\})\;'
+                                'window\.__appInfo = (?P<appInfo>\{[^\n]+\})\;\n'
                  ),
                  // the title/description/name contains suspicious keywords
                  any([

Original file line number	Diff line number	Diff line change
`@@ -19,7 +19,7 @@ source: \|`
`19`	`19`	`)`
`20`	`20`	`// it contains suspicious elements within the extracted "appInfo"`
`21`	`21`	`or any(regex.iextract(ml.link_analysis(.).final_dom.raw,`
`22`		`- 'window\.__appInfo = (?P<appInfo>\{[^\;]+\})\;'`
	`22`	`+ 'window\.__appInfo = (?P<appInfo>\{[^\n]+\})\;\n'`
`23`	`23`	`),`
`24`	`24`	`// the title/description/name contains suspicious keywords`
`25`	`25`	`any([`