diff --git a/http/vulnerabilities/other/flir-ax8-rce.yaml b/http/vulnerabilities/other/flir-ax8-rce.yaml
index 78fc2df7ce..b8732a4ba6 100644
--- a/http/vulnerabilities/other/flir-ax8-rce.yaml
+++ b/http/vulnerabilities/other/flir-ax8-rce.yaml
@@ -39,7 +39,8 @@ http:
     matchers:
       - type: dsl
         dsl:
-          - contains_all(tolower(header), 'text/html','phpsessid','showcameraid', 'success')
+          - contains_all(to_lower(header_1), 'text/html','phpsessid','showcameraid')
+          - contains(body_1, 'success')
           - status_code_1 == 200 && status_code_2 == 200
         condition: and