diff --git a/detection-rules/attachment_encrypted_pdf_cred_theft.yml b/detection-rules/attachment_encrypted_pdf_cred_theft.yml
index 69422fcf006..bf2ddbf8352 100644
--- a/detection-rules/attachment_encrypted_pdf_cred_theft.yml
+++ b/detection-rules/attachment_encrypted_pdf_cred_theft.yml
@@ -23,7 +23,7 @@ source: |
            .name == "cred_theft" and .confidence in ("medium", "high")
     )
     or regex.icontains(body.current_thread.text,
-                       'PDF\s*(?:Access|Preview|Unlock|Decrypt|passcode)',
+                       'PDF\s*(?:Access|Preview|Unlock|Decrypt|pass(?:code|word))',
                        '(Access|Preview|Unlock|Decrypt|Pass)\s*(?:word|code)\s*(?:\S+\s+){0,3}PDF\s*is?\s*:',
                        'This\s+(?:file|document|pdf)\s+is\s+(?:password[-\s]?)\s+protected\.\s*The\s+password\s+is\s*:?',
                        '(?:Access|Preview|Unlock|Decrypt)\s+(?:\S+\s+){0,3}(?:PDF|statement)(?:\S+\s+){0,3}(?:pass(?:word|code)|\s*with\s+\S+)'
@@ -35,7 +35,7 @@ source: |
       )
       and any(body.previous_threads,
               regex.icontains(.text,
-                              'PDF\s*(?:Access|Preview|Unlock|Decrypt|passcode)',
+                              'PDF\s*(?:Access|Preview|Unlock|Decrypt|pass(?:code|word))',
                               '(Access|Preview|Unlock|Decrypt|Pass)\s*(?:word|code)\s*(?:\S+\s+){0,3}PDF\s*is?\s*:',
                               'This\s+(?:file|document|pdf)\s+is\s+(?:password[-\s]?)\s+protected\.\s*The\s+password\s+is\s*:?',
                               '(?:Access|Preview|Unlock|Decrypt)\s+(?:\S+\s+){0,3}(?:PDF|statement)(?:\S+\s+){0,3}(?:pass(?:word|code)|\s*with\s+\S+)'