[Test Rules] [PR #4691] modified rule: Cloud storage impersonation with credential theft indicators

github-actions[bot] · github-actions[bot] · commit 1ab3e67a3d6f · 2026-06-23T16:13:34.000Z
diff --git a/detection-rules/4691_credential_theft_cloud_storage_impersonation.yml b/detection-rules/4691_credential_theft_cloud_storage_impersonation.yml
@@ -6,7 +6,7 @@ source: |
   type.inbound
   and (
     0 < length(body.current_thread.links) < 10
-    or length(body.current_thread.links) > 50
+    or length(body.current_thread.links) > 100
   )
   and any([subject.subject, sender.display_name],
           regex.icontains(.,
@@ -48,12 +48,7 @@ source: |
                                                                            ""
             )
           )
-          or (
-            any(body.links,
-                regex.icontains(.href_url.url, '(?:;[^/]*){3,}')
-                or regex.icontains(.href_url.path, '@')
-            )
-          )
+          or any(body.links, regex.icontains(.href_url.url, '(?:;[^/]*){3,}'))
         )
     )
   )
@@ -83,4 +78,4 @@ detection_methods:
 id: "1228585e-ce7d-5186-acc8-369a0f9e3c15"
 og_id: "4c20f72c-0045-518c-8157-7dad5f196ecc"
 testing_pr: 4691
-testing_sha: 6d26229a095381ae2ac0bcc6dd847a243f258692
+testing_sha: 923751758d81b293ded07d1c7c16f5297b94295d

Original file line number	Diff line number	Diff line change
`@@ -6,7 +6,7 @@ source: \|`
`6`	`6`	`type.inbound`
`7`	`7`	`and (`
`8`	`8`	`0 < length(body.current_thread.links) < 10`
`9`		`- or length(body.current_thread.links) > 50`
	`9`	`+ or length(body.current_thread.links) > 100`
`10`	`10`	`)`
`11`	`11`	`and any([subject.subject, sender.display_name],`
`12`	`12`	`regex.icontains(.,`
`@@ -48,12 +48,7 @@ source: \|`
`48`	`48`	`""`
`49`	`49`	`)`
`50`	`50`	`)`
`51`		`- or (`
`52`		`- any(body.links,`
`53`		`- regex.icontains(.href_url.url, '(?:;[^/]*){3,}')`
`54`		`- or regex.icontains(.href_url.path, '@')`
`55`		`- )`
`56`		`- )`
	`51`	`+ or any(body.links, regex.icontains(.href_url.url, '(?:;[^/]*){3,}'))`
`57`	`52`	`)`
`58`	`53`	`)`
`59`	`54`	`)`
`@@ -83,4 +78,4 @@ detection_methods:`
`83`	`78`	`id: "1228585e-ce7d-5186-acc8-369a0f9e3c15"`
`84`	`79`	`og_id: "4c20f72c-0045-518c-8157-7dad5f196ecc"`
`85`	`80`	`testing_pr: 4691`
`86`		`-testing_sha: 6d26229a095381ae2ac0bcc6dd847a243f258692`
	`81`	`+testing_sha: 923751758d81b293ded07d1c7c16f5297b94295d`