Skip to content

Commit

Permalink
Update impersonation_sharepoint_fake_file_share.yml
Browse files Browse the repository at this point in the history
test removing of sender profile logic
  • Loading branch information
zoomequipd authored Jan 6, 2025
1 parent 00287f1 commit a23280b
Showing 1 changed file with 9 additions and 9 deletions.
18 changes: 9 additions & 9 deletions detection-rules/impersonation_sharepoint_fake_file_share.yml
Original file line number Diff line number Diff line change
Expand Up @@ -273,15 +273,15 @@ source: |
)
or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)
and (
profile.by_sender().solicited == false
or profile.by_sender_email().prevalence == "new"
or (
profile.by_sender().any_messages_malicious_or_spam
and not profile.by_sender().any_false_positives
)
)
and not profile.by_sender().any_false_positives
// and (
// profile.by_sender().solicited == false
// or profile.by_sender_email().prevalence == "new"
// or (
// profile.by_sender().any_messages_malicious_or_spam
// and not profile.by_sender().any_false_positives
// )
// )
// and not profile.by_sender().any_false_positives
attack_types:
- "Credential Phishing"
- "Malware/Ransomware"
Expand Down

0 comments on commit a23280b

Please sign in to comment.