Update jar-attachments.md

martyav · web-flow · commit 0e92475f6a8a · 2020-11-04T15:48:37.000-05:00
To account for multiple attachments
diff --git a/Initial access/jar-attachments.md b/Initial access/jar-attachments.md
@@ -15,7 +15,7 @@ let mailsHTML = EmailAttachmentInfo
 | where FileType startswith "Jar"
 | distinct NetworkMessageId;
 EmailEvents
-| where NetworkMessageId in (mailsHTML) and AttachmentCount == 1
+| where NetworkMessageId in (mailsHTML) and AttachmentCount > 0
 ```
 
 ## Category
