Removing terms in phishing post signatures that were causing false po…

…sitives
CybercentreCanada · Jun 14, 2024 · c277ea4 · c277ea4
1 parent 3fb6397
commit c277ea4
Showing 1 changed file with 3 additions and 3 deletions.
diff --git a/signatures/phishing.py b/signatures/phishing.py
@@ -136,7 +136,7 @@ def process_output(self, output):
                     "T3R0YXdh",
                     "b3R0YXdh",
                     # Canada + Canada b64'd + canada b64'd
-                    "Canada",
+                    # "Canada", Removed due to FPs
                     "Q2FuYWRh",
                     "Y2FuYWRh",
                     # 1A1 A1A + 1A1 A1A b64'd + 1a1 a1a b64'd
@@ -192,8 +192,8 @@ def process_output(self, output):
                 "method": ANY,
                 "indicators": [
                     "maiden",
-                    "expiry",
-                    "billing",
+                    # "expiry", Removed due to FPs
+                    # "billing", Removed due to FPs
                 ],
             },
         ]