diff --git a/detection-rules/impersonation_sharepoint_fake_file_share.yml b/detection-rules/impersonation_sharepoint_fake_file_share.yml index 024f1f19389..954bffa4eb9 100644 --- a/detection-rules/impersonation_sharepoint_fake_file_share.yml +++ b/detection-rules/impersonation_sharepoint_fake_file_share.yml @@ -273,15 +273,15 @@ source: | ) or sender.email.domain.root_domain not in $high_trust_sender_root_domains ) - and ( - profile.by_sender().solicited == false - or profile.by_sender_email().prevalence == "new" - or ( - profile.by_sender().any_messages_malicious_or_spam - and not profile.by_sender().any_false_positives - ) - ) - and not profile.by_sender().any_false_positives + // and ( + // profile.by_sender().solicited == false + // or profile.by_sender_email().prevalence == "new" + // or ( + // profile.by_sender().any_messages_malicious_or_spam + // and not profile.by_sender().any_false_positives + // ) + // ) + // and not profile.by_sender().any_false_positives attack_types: - "Credential Phishing" - "Malware/Ransomware"