type.inbound
and (length(body.plain.raw) < 200 or body.plain.raw is null)
and regex.icontains(body.html.raw,
"document.{0,10}(write|insertAdjacentHTML).{0,10}atob"
)
Playground
Test against your own EMLs or sample data.
type.inbound
and (length(body.plain.raw) < 200 or body.plain.raw is null)
and regex.icontains(body.html.raw,
"document.{0,10}(write|insertAdjacentHTML).{0,10}atob"
)
Test against your own EMLs or sample data.