[Test Rules] [PR #4515] modified rule: VIP Impersonation via Google Group relay with suspicious indicators

Author: github-actions[bot]

detection-rules/4515_impersonation_google_groups_suspicious.yml

@@ -11,31 +11,37 @@ source: |
     any(headers.reply_to,
         any($org_vips,
             strings.contains(.display_name, ..display_name)
-            or strings.contains(strings.concat(.first_name, " ", .last_name),
-                                ..display_name
-            )
             or strings.contains(strings.concat(.last_name, ", ", .first_name),
                                 ..display_name
             )
+            or any(regex.extract(.display_name,
+                                 '\A(?P<name>.+?)\s*[\(（][^)）]*[)）]\s*\z'
+                   ),
+                   strings.contains(.named_groups["name"], ...display_name)
+            )
         )
     )
     or any($org_vips,
            strings.contains(subject.subject, .display_name)
-           or strings.contains(subject.subject,
-                               strings.concat(.first_name, " ", .last_name)
-           )
            or strings.contains(subject.subject,
                                strings.concat(.last_name, ", ", .first_name)
            )
+           or any(regex.extract(.display_name,
+                                '\A(?P<name>.+?)\s*[\(（][^)）]*[)）]\s*\z'
+                  ),
+                  strings.contains(subject.subject, .named_groups["name"])
+           )
     )
     or any($org_vips,
            strings.contains(sender.display_name, .display_name)
-           or strings.contains(sender.display_name,
-                               strings.concat(.first_name, " ", .last_name)
-           )
            or strings.contains(sender.display_name,
                                strings.concat(.last_name, ", ", .first_name)
            )
+           or any(regex.extract(.display_name,
+                                '\A(?P<name>.+?)\s*[\(（][^)）]*[)）]\s*\z'
+                  ),
+                  strings.contains(sender.display_name, .named_groups["name"])
+           )
     )
   )
   and any(headers.hops,
@@ -104,4 +110,4 @@ detection_methods:
 id: "674a5349-ceb9-5831-af1c-175d9fa6dbd7"
 og_id: "57f9cd3b-ddac-5ef5-96dd-374dbd03f5cd"
 testing_pr: 4515
-testing_sha: 1658ad9fc984cdf4e2a8a85f6af83206ffd6dde1
+testing_sha: 3c7644f9963fb214445fd5add76ce8f949a4acf0