Refine name and description for UPS impersonation rule#4633
Conversation
cybher0808
added
the
in-test-rules
|
Most recent - update after sharing results from mode - hunt - 3Days. Submitting a R4R. |
| @@ -1,6 +1,6 @@ | |||
| name: "Brand impersonation: UPS" | |||
| name: "Brand Impersonation: UPS Delivery" | |||
There was a problem hiding this comment.
| name: "Brand Impersonation: UPS Delivery" | |
| name: "Brand impersonation: UPS Delivery" |
Is UPS Delivery the name of the org? Genuinely not sure, if it's just the word "delivery" lets lowercase that please and thank you!
| and sender.email.domain.root_domain not in ("ups.com", "upsemail.com") | ||
| and ( | ||
| sender.display_name in~ ("UPS My Choice", "UPS Services") | ||
| or regex.icontains(sender.display_name, 'UPS-\w+') |
There was a problem hiding this comment.
Non blocking since it's alllll over this rule, but icontains is case insensitive so no need to all-caps that. Also I found a sample that we might want to match on this but it's Ups.com so your "-" here causes it not to match, you don't have to hoover this up into your change and I'm aligned with approving this tbh but wanted to show you: https://platform.sublime.security/messages/507db04ef7f2d59883b680ea4827f37284d34299084e48bef04816fda4afdaab?preview_id=019e84b4-3c38-7661-8dfe-1663a5f2ed4f nice find on this!
2 participants
Description
Adding
UPS-\w+for sender.display to the rule.Associated samples
Associated hunts