[Test Rules] [PR #4513] modified rule: VIP impersonation with w2 request with reply-to mismatch

Author: github-actions[bot]

detection-rules/4513_impersonation_vip_w2_request.yml

@@ -7,12 +7,14 @@ source: |
   and (
     any($org_vips,
         strings.contains(sender.display_name, .display_name)
-        or strings.contains(sender.display_name,
-                            strings.concat(.first_name, " ", .last_name)
-        )
         or strings.contains(sender.display_name,
                             strings.concat(.last_name, ", ", .first_name)
         )
+        or any(regex.extract(.display_name,
+                             '\A(?P<name>.+?)\s*[\(（][^)）]*[)）]\s*\z'
+               ),
+               strings.contains(sender.display_name, .named_groups["name"])
+        )
     )
     or any(regex.extract(sender.display_name, '^(?<first>\S+)\s+(?<second>\S+)$'),
            any($org_vips,
@@ -59,4 +61,4 @@ detection_methods:
 id: "49b212a6-2fa1-5f27-b18e-75126c6b337c"
 og_id: "e7e73fad-6ce6-51f9-9b52-40eaef71f5a1"
 testing_pr: 4513
-testing_sha: 90a3176084fd25d367a7582d78b2cd7bb9c4b8b5
+testing_sha: 8edfcb14502fda5aa8241629f8b4a08bbe1eefc7