[Test Rules] [PR #4513] modified rule: VIP / Executive impersonation (strict match, untrusted)

Author: github-actions[bot]

detection-rules/4513_vip_impersonation.yml

@@ -16,12 +16,8 @@ source: |
     // the display name matches a name on the orgs vip list
     any($org_vips,
         .display_name =~ sender.display_name
+        or strings.concat(.first_name, " ", .last_name) =~ sender.display_name
         or strings.concat(.last_name, ", ", .first_name) =~ sender.display_name
-        or any(regex.extract(.display_name,
-                             '\A(?P<name>.+?)\s*[\(（][^)）]*[)）]\s*\z'
-               ),
-               .named_groups["name"] =~ sender.display_name
-        )
     )
     // or the display name starts with the name on the orgs vip list
     or (
@@ -30,6 +26,16 @@ source: |
             strings.istarts_with(sender.display_name, .display_name)
             and length(sender.display_name) > length(.display_name)
           )
+          or (
+            strings.istarts_with(sender.display_name,
+                                 strings.concat(.first_name, " ", .last_name)
+            )
+            and length(sender.display_name) > length(strings.concat(.first_name,
+                                                                    " ",
+                                                                    .last_name
+                                                     )
+            )
+          )
           or (
             strings.istarts_with(sender.display_name,
                                  strings.concat(.last_name, ", ", .first_name)
@@ -40,12 +46,6 @@ source: |
                                                      )
             )
           )
-          or any(regex.extract(.display_name,
-                               '\A(?P<name>.+?)\s*[\(（][^)）]*[)）]\s*\z'
-                 ),
-                 strings.istarts_with(sender.display_name, .named_groups["name"])
-                 and length(sender.display_name) > length(.named_groups["name"])
-          )
       )
       // and we have confidence it's BEC
       and any(ml.nlu_classifier(body.current_thread.text).intents,
@@ -119,4 +119,4 @@ detection_methods:
 id: "83f40c96-2ae9-501e-88ca-20a711a01b89"
 og_id: "e42c84b7-9d50-5870-9a5d-311670a14bc1"
 testing_pr: 4513
-testing_sha: 8edfcb14502fda5aa8241629f8b4a08bbe1eefc7
+testing_sha: 4e4a7760ad81eb7d66ae5f3e4701e7923ebb1f45