From c1f23c2dcd966d6f4091b7851437515cab661b1d Mon Sep 17 00:00:00 2001 From: kazet Date: Tue, 23 Jan 2024 15:51:02 +0100 Subject: [PATCH] Update http/miscellaneous/balada-injector-malware.yaml Co-authored-by: msm-cert <156842376+msm-cert@users.noreply.github.com> --- http/miscellaneous/balada-injector-malware.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/http/miscellaneous/balada-injector-malware.yaml b/http/miscellaneous/balada-injector-malware.yaml index 7af729a902..d87a2c037c 100644 --- a/http/miscellaneous/balada-injector-malware.yaml +++ b/http/miscellaneous/balada-injector-malware.yaml @@ -24,7 +24,7 @@ http: - type: regex part: body regex: - - '(?mi)sgpbWillOpen", function\(e\) {if \(e.detail.popupId.{0,100}eval.{0,100}atob' + - '(?mi)sgpbWillOpen", *function\(e\) *{if *\(e[.]detail[.]popupId.{0,100}eval.{0,100}atob' - type: word part: header