[Test Rules] [PR #4515] modified rule: Fake thread with suspicious indicators

Author: github-actions[bot]

detection-rules/4515_fake_thread_suspicious_indicators.yml

@@ -122,23 +122,19 @@ source: |
       any($org_vips,
           strings.icontains(body.html.inner_text, .display_name)
           or strings.icontains(body.html.inner_text,
-                               strings.concat(.last_name, ", ", .first_name)
+                               strings.concat(.first_name, " ", .last_name)
           )
-          or any(regex.extract(.display_name,
-                               '\A(?P<name>.+?)\s*[\(（][^)）]*[)）]\s*\z'
-                 ),
-                 strings.icontains(body.html.inner_text, .named_groups["name"])
+          or strings.icontains(body.html.inner_text,
+                               strings.concat(.last_name, ", ", .first_name)
           )
       )
       or any($org_vips,
              strings.icontains(body.plain.raw, .display_name)
              or strings.icontains(body.plain.raw,
-                                  strings.concat(.last_name, ", ", .first_name)
+                                  strings.concat(.first_name, " ", .last_name)
              )
-             or any(regex.extract(.display_name,
-                                  '\A(?P<name>.+?)\s*[\(（][^)）]*[)）]\s*\z'
-                    ),
-                    strings.icontains(body.plain.raw, .named_groups["name"])
+             or strings.icontains(body.plain.raw,
+                                  strings.concat(.last_name, ", ", .first_name)
              )
       )
     ),
@@ -208,4 +204,4 @@ detection_methods:
 id: "5bdf57da-06d5-51ea-bcf6-4a6be0d461bb"
 og_id: "c2e18a57-1f52-544f-bb6d-a578e286cf89"
 testing_pr: 4515
-testing_sha: 3c7644f9963fb214445fd5add76ce8f949a4acf0
+testing_sha: c9ede5003470372be79cb7ad142656d7202a6329