[Shared Samples] [PR #4667] modified rule: PR# 4667 - Link: Self-sender with IP geolocation check and suspicious link behavior

Author: github-actions[bot]

detection-rules/4667_link_self_sender_ip_check.yml

@@ -9,22 +9,15 @@ source: |
     length(recipients.to) == 1
     and recipients.to[0].email.email == sender.email.email
   )
-  and any(body.current_thread.links,
-          .href_url.domain.root_domain != sender.email.domain.root_domain
-          and any(ml.link_analysis(.).unique_urls_accessed,
-                  .url == 'https://ipinfo.io/json'
-          )
-          and (
-            strings.icontains(ml.link_analysis(.).final_dom.raw,
-                              'Math.floor',
-                              'Math.random'
-            )
-            or (
-              ml.link_analysis(.).credphish.disposition == "phishing"
-              and ml.link_analysis(.).credphish.confidence in ("medium", "high")
-            )
+  and 0 < length(body.current_thread.links) < 10
+  and any(filter(body.current_thread.links,
+                 .href_url.domain.root_domain != sender.email.domain.root_domain
+          ),
+          any(ml.link_analysis(.).unique_urls_accessed,
+              .url == 'https://ipinfo.io/json'
           )
   )
+  and not headers.return_path.domain.root_domain == "salesforce.com"
 attack_types:
   - "Credential Phishing"
 tactics_and_techniques: