[Shared Samples] [PR #4515] modified rule: PR# 4515 - VIP impersonation: Fake thread with display name match, email mismatch

Author: github-actions[bot]

detection-rules/4515_vip_impersonation_fake_thread.yml

@@ -6,26 +6,37 @@ source: |
   type.inbound
   and any($org_vips,
           (
-            strings.icontains(body.html.display_text,
-                              strings.concat("From: ", .display_name, " <")
+            (
+              .display_name != ""
+              and strings.icontains(body.html.display_text,
+                                    strings.concat("From: ", .display_name, " <")
+              )
             )
-            or strings.icontains(body.html.display_text,
-                                 strings.concat("From: ",
-                                                strings.concat(.first_name,
-                                                               " ",
-                                                               .last_name
-                                                ),
-                                                " <"
-                                 )
+            or (
+              .first_name != ""
+              and .last_name != ""
+              and strings.icontains(body.html.display_text,
+                                    strings.concat("From: ",
+                                                   strings.concat(.first_name,
+                                                                  " ",
+                                                                  .last_name
+                                                   ),
+                                                   " <"
+                                    )
+              )
             )
-            or strings.icontains(body.html.display_text,
-                                 strings.concat("From: ",
-                                                strings.concat(.last_name,
-                                                               ", ",
-                                                               .first_name
-                                                ),
-                                                " <"
-                                 )
+            or (
+              .first_name != ""
+              and .last_name != ""
+              and strings.icontains(body.html.display_text,
+                                    strings.concat("From: ",
+                                                   strings.concat(.last_name,
+                                                                  ", ",
+                                                                  .first_name
+                                                   ),
+                                                   " <"
+                                    )
+              )
             )
           )
           and not (