diff --git a/PROJECTS/advanced/ai-threat-detection/backend/app/core/features/patterns.py b/PROJECTS/advanced/ai-threat-detection/backend/app/core/features/patterns.py
index 9b02a650..112f69fb 100644
--- a/PROJECTS/advanced/ai-threat-detection/backend/app/core/features/patterns.py
+++ b/PROJECTS/advanced/ai-threat-detection/backend/app/core/features/patterns.py
@@ -112,7 +112,7 @@ _XXE_INJECTION = (
     r"xmlns\s*:\s*xi\s*=|"
     r"%(?:25)?3[Cc]!(?:ENTITY|DOCTYPE)|"
     r"&(?:xxe|xml|ext|file);|"
-    r"%(?:25)?(?:53|73)(?:25)?(?:59|79)(?:25)?(?:53|73)(?:25)?(?:54|74)(?:25)?(?:45|65)(?:25)?(?:4d|6d))")
+    r"%(?:25)?(?:53|73)%(?:25)?(?:59|79)%(?:25)?(?:53|73)%(?:25)?(?:54|74)%(?:25)?(?:45|65)%(?:25)?(?:4[Dd]))")
 
 _SSRF = (
     r"(?:169\.254\.169\.254|"