[Test Rules] [PR #4513] modified rule: VIP impersonation with urgent request (strict match, untrusted sender)

Author: github-actions[bot]

detection-rules/4513_impersonation_vip_urgent_request.yml

@@ -8,9 +8,17 @@ severity: "high"
 source: |
   type.inbound
   and any($org_vips,
-          .display_name =~ sender.display_name
-          or strings.concat(.first_name, " ", .last_name) =~ sender.display_name
-          or strings.concat(.last_name, ", ", .first_name) =~ sender.display_name
+          (.display_name != "" and .display_name =~ sender.display_name)
+          or (
+            .first_name != ""
+            and .last_name != ""
+            and strings.concat(.first_name, " ", .last_name) =~ sender.display_name
+          )
+          or (
+            .first_name != ""
+            and .last_name != ""
+            and strings.concat(.last_name, ", ", .first_name) =~ sender.display_name
+          )
   )
   and (
     any(ml.nlu_classifier(body.current_thread.text).intents,
@@ -64,4 +72,4 @@ detection_methods:
 id: "5bb1c65e-b217-59bc-b9a6-4b7e6defc225"
 og_id: "0dd1fa60-6e89-5f70-81a1-6b64eef0e428"
 testing_pr: 4513
-testing_sha: 4e4a7760ad81eb7d66ae5f3e4701e7923ebb1f45
+testing_sha: 14caf0d1fb8deb9470797e8b93fc8c0756120fa3