[Test Rules] [PR #4498] modified rule: Link: Generic financial document and suspicious hosting template

Author: github-actions[bot]

detection-rules/4498_link_financial_document_timeline_template.yml

@@ -4,14 +4,11 @@ type: "rule"
 severity: "medium"
 source: |
   type.inbound
-  // standard generic greeting
-  and (
-    strings.istarts_with(body.current_thread.text, "dear sir/madam")
-    // expectation of time
-    and regex.icontains(body.current_thread.text,
-                        'will be released|\b[1-4].[1-4]\b.{1,10}days?'
-    )
+  // expectation of time
+  and regex.icontains(body.current_thread.text,
+                      'will be released|\b[1-4].[1-4]\b.{1,10}days?'
   )
+  
   // link is malicious
   and any(body.links,
           // key phrasing or nlu
@@ -42,16 +39,10 @@ source: |
       and length(recipients.cc) == 0
       and sender.email.email == recipients.to[0].email.email
     )
-    // no recipient
+    // the recipient is undisclosed or there are no recipients
     or (
-      (
-        length(recipients.to) == 0
-        and length(recipients.bcc) == 0
-        and length(recipients.cc) == 0
-      )
-      or any(recipients.to,
-             strings.ilike(.display_name, "undisclosed?recipients")
-      )
+      length(recipients.to) == 0
+      or all(recipients.to, .email.domain.valid == false)
     )
   )
 
@@ -72,4 +63,4 @@ detection_methods:
 id: "1a6e4ced-4391-597f-9184-d4d1c57dedc7"
 og_id: "027cb65d-aee3-5f10-9555-20b719bbde42"
 testing_pr: 4498
-testing_sha: a68fc0d514655d0c378e43c8700abcf31b7af00e
+testing_sha: 9384da2d92eb56b85e45f5eee0fdc7c27fc77479