YARA rule for Markdown exfiltration

[deadbits]

rule MarkdownExfiltration
{
    meta:
        category = "Data Exfiltration"
        description = "Detects Markdown image with query parameters used during data exfiltration"
        author = "Adam M. Swanda"
        references = "https://embracethered.com/blog/posts/2023/bing-chat-data-exfiltration-poc-and-fix/"

    strings:
        $md = /\!\[.+]\(https?://[a-z\.]+/logo\.png\?q=.+\)/
    condition:
        $md
}

something like that but better regex

[deadbits]

https://github.com/deadbits/vigil-llm/blob/main/data/yara/mdexfil.yar