Skip to content

Add first_name/last_name concat matching to org_vips body/subject rules#4515

Open
IndiaAce wants to merge 6 commits into
sublime-security:mainfrom
IndiaAce:india.fn.na.org_vips_name_ordering_body_subject
Open

Add first_name/last_name concat matching to org_vips body/subject rules#4515
IndiaAce wants to merge 6 commits into
sublime-security:mainfrom
IndiaAce:india.fn.na.org_vips_name_ordering_body_subject

Conversation

@IndiaAce

Copy link
Copy Markdown
Member

Description

Add alternative name matching logic to org_vips body/subject/HTML-based rules to handle cases where
display_name is stored as "Lastname, Firstname" instead of "Firstname Lastname".
Uses strings.concat(.first_name, " ", .last_name) and strings.concat(.last_name, ", ", .first_name)
as additional or conditions inside existing any($org_vips, ...) blocks.

This is a test rule deployment to assess impact magnitude.

Affected rules

  • vip_impersonation_charity.yml
  • fake_thread_suspicious_indicators.yml
  • vip_impersonation_subject.yml
  • vip_impersonation_fake_thread.yml
  • impersonation_google_groups_suspicious.yml
  • service_abuse_trello_board_invite_vip.yml

Associated samples

N/A - validation only (no TP canonical available)

Associated hunts

TBD - will be run after test rule deployment

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@IndiaAce IndiaAce requested a review from a team May 20, 2026 16:52
@IndiaAce IndiaAce requested a review from a team as a code owner May 20, 2026 16:52
@github-actions github-actions Bot added the in-test-rules PR is in our testing suite to collect telemetry label May 20, 2026
github-actions Bot added a commit that referenced this pull request May 20, 2026
github-actions Bot added a commit that referenced this pull request May 20, 2026
github-actions Bot added a commit that referenced this pull request May 20, 2026
github-actions Bot added a commit that referenced this pull request May 20, 2026
github-actions Bot added a commit that referenced this pull request May 20, 2026
github-actions Bot added a commit to IndiaAce/sublime-rules that referenced this pull request May 20, 2026
github-actions Bot added a commit to IndiaAce/sublime-rules that referenced this pull request May 20, 2026
… via Google Group relay with suspicious indicators
github-actions Bot added a commit to IndiaAce/sublime-rules that referenced this pull request May 20, 2026
…ello board invitation with VIP impersonation
github-actions Bot added a commit to IndiaAce/sublime-rules that referenced this pull request May 20, 2026
github-actions Bot added a commit to IndiaAce/sublime-rules that referenced this pull request May 20, 2026
…: Fake thread with display name match, email mismatch
github-actions Bot added a commit to IndiaAce/sublime-rules that referenced this pull request May 20, 2026
github-actions Bot added a commit that referenced this pull request May 20, 2026
github-actions Bot added a commit that referenced this pull request May 20, 2026
…via Google Group relay with suspicious indicators
github-actions Bot added a commit that referenced this pull request May 20, 2026
…llo board invitation with VIP impersonation
github-actions Bot added a commit that referenced this pull request May 20, 2026
github-actions Bot added a commit that referenced this pull request May 20, 2026
… Fake thread with display name match, email mismatch
github-actions Bot added a commit that referenced this pull request May 20, 2026
IndiaAce and others added 2 commits May 29, 2026 15:09
…al stripping

- Remove redundant strings.concat(.first_name, " ", .last_name) checks (already covered by .display_name)
- Keep strings.concat(.last_name, ", ", .first_name) for orgs storing VIPs as "Doe, John"
- Add regex-based parenthetical stripping for VIP names like "Shelly Chaka (She/her/hers)"
- Handles both ASCII () and full-width () parentheses

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
github-actions Bot added a commit that referenced this pull request May 29, 2026
github-actions Bot added a commit that referenced this pull request May 29, 2026
github-actions Bot added a commit that referenced this pull request May 29, 2026
github-actions Bot added a commit that referenced this pull request May 29, 2026
github-actions Bot added a commit that referenced this pull request May 29, 2026
github-actions Bot added a commit to IndiaAce/sublime-rules that referenced this pull request May 29, 2026
…ion via Google Group relay with suspicious indicators
github-actions Bot added a commit to IndiaAce/sublime-rules that referenced this pull request May 29, 2026
… Trello board invitation with VIP impersonation
github-actions Bot added a commit to IndiaAce/sublime-rules that referenced this pull request May 29, 2026
github-actions Bot added a commit to IndiaAce/sublime-rules that referenced this pull request May 29, 2026
…ion: Fake thread with display name match, email mismatch
github-actions Bot added a commit to IndiaAce/sublime-rules that referenced this pull request May 29, 2026
github-actions Bot added a commit that referenced this pull request May 29, 2026
github-actions Bot added a commit that referenced this pull request May 29, 2026
…on via Google Group relay with suspicious indicators
github-actions Bot added a commit that referenced this pull request May 29, 2026
…Trello board invitation with VIP impersonation
github-actions Bot added a commit that referenced this pull request May 29, 2026
github-actions Bot added a commit that referenced this pull request May 29, 2026
…on: Fake thread with display name match, email mismatch
github-actions Bot added a commit that referenced this pull request May 29, 2026
github-actions Bot added a commit that referenced this pull request May 29, 2026
github-actions Bot added a commit that referenced this pull request May 29, 2026
github-actions Bot added a commit that referenced this pull request May 29, 2026
github-actions Bot added a commit that referenced this pull request May 29, 2026
github-actions Bot added a commit that referenced this pull request May 29, 2026
github-actions Bot added a commit that referenced this pull request May 29, 2026
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
github-actions Bot added a commit that referenced this pull request Jun 8, 2026
github-actions Bot added a commit that referenced this pull request Jun 8, 2026
…on via Google Group relay with suspicious indicators
github-actions Bot added a commit that referenced this pull request Jun 8, 2026
…Trello board invitation with VIP impersonation
github-actions Bot added a commit that referenced this pull request Jun 8, 2026
github-actions Bot added a commit that referenced this pull request Jun 8, 2026
…on: Fake thread with display name match, email mismatch
github-actions Bot added a commit that referenced this pull request Jun 8, 2026
github-actions Bot added a commit that referenced this pull request Jun 8, 2026
github-actions Bot added a commit that referenced this pull request Jun 8, 2026
github-actions Bot added a commit that referenced this pull request Jun 8, 2026
github-actions Bot added a commit that referenced this pull request Jun 8, 2026
github-actions Bot added a commit that referenced this pull request Jun 8, 2026
github-actions Bot added a commit that referenced this pull request Jun 8, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

in-test-rules PR is in our testing suite to collect telemetry

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant