[Shared Samples] [PR #4515] modified rule: PR# 4515 - Service abuse: Trello board invitation with VIP impersonation

Author: github-actions[bot]

detection-rules/4515_service_abuse_trello_board_invite_vip.yml

@@ -28,12 +28,23 @@ source: |
     any(html.xpath(body.html, '//h2').nodes,
         // org vip
         any($org_vips,
-            strings.icontains(..display_text, .display_name)
-            or strings.icontains(..display_text,
-                                 strings.concat(.first_name, " ", .last_name)
+            (
+              .display_name != ""
+              and strings.icontains(..display_text, .display_name)
             )
-            or strings.icontains(..display_text,
-                                 strings.concat(.last_name, ", ", .first_name)
+            or (
+              .first_name != ""
+              and .last_name != ""
+              and strings.icontains(..display_text,
+                                    strings.concat(.first_name, " ", .last_name)
+              )
+            )
+            or (
+              .first_name != ""
+              and .last_name != ""
+              and strings.icontains(..display_text,
+                                    strings.concat(.last_name, ", ", .first_name)
+              )
             )
         )
         // org sld as the board name
@@ -50,18 +61,29 @@ source: |
            strings.starts_with(.display_text, 'A note from ')
            and strings.iends_with(.display_text, 'From')
            and any($org_vips,
-                   strings.icontains(..display_text, .display_name)
-                   or strings.icontains(..display_text,
-                                        strings.concat(.first_name,
-                                                       " ",
-                                                       .last_name
-                                        )
+                   (
+                     .display_name != ""
+                     and strings.icontains(..display_text, .display_name)
+                   )
+                   or (
+                     .first_name != ""
+                     and .last_name != ""
+                     and strings.icontains(..display_text,
+                                           strings.concat(.first_name,
+                                                          " ",
+                                                          .last_name
+                                           )
+                     )
                    )
-                   or strings.icontains(..display_text,
-                                        strings.concat(.last_name,
-                                                       ", ",
-                                                       .first_name
-                                        )
+                   or (
+                     .first_name != ""
+                     and .last_name != ""
+                     and strings.icontains(..display_text,
+                                           strings.concat(.last_name,
+                                                          ", ",
+                                                          .first_name
+                                           )
+                     )
                    )
            )
     )