[Shared Samples] [PR #4513] modified rule: PR# 4513 - VIP impersonation with BEC language (near match, untrusted sender)

Author: github-actions[bot]

detection-rules/4513_impersonation_vip_bec_loose.yml

@@ -9,19 +9,18 @@ source: |
   type.inbound
   and any($org_vips,
           0 <= strings.ilevenshtein(sender.display_name, .display_name) < 4
+          or 0 <= strings.ilevenshtein(sender.display_name,
+                                       strings.concat(.first_name,
+                                                      " ",
+                                                      .last_name
+                                       )
+          ) < 4
           or 0 <= strings.ilevenshtein(sender.display_name,
                                        strings.concat(.last_name,
                                                       ", ",
                                                       .first_name
                                        )
           ) < 4
-          or any(regex.extract(.display_name,
-                               '\A(?P<name>.+?)\s*[\(（][^)）]*[)）]\s*\z'
-                 ),
-                 0 <= strings.ilevenshtein(sender.display_name,
-                                           .named_groups["name"]
-                 ) < 4
-          )
   )
   and any(ml.nlu_classifier(body.current_thread.text).intents,
           .name == "bec" and .confidence in ("medium", "high")