[Test Rules] [PR #4515] modified rule: VIP impersonation with charitable donation fraud

Author: github-actions[bot]

detection-rules/4515_vip_impersonation_charity.yml

@@ -19,21 +19,25 @@ source: |
   and (
     any($org_vips,
         strings.icontains(body.html.inner_text, .display_name)
-        or strings.icontains(body.html.inner_text,
-                             strings.concat(.first_name, " ", .last_name)
-        )
         or strings.icontains(body.html.inner_text,
                              strings.concat(.last_name, ", ", .first_name)
         )
+        or any(regex.extract(.display_name,
+                             '\A(?P<name>.+?)\s*[\(（][^)）]*[)）]\s*\z'
+               ),
+               strings.icontains(body.html.inner_text, .named_groups["name"])
+        )
     )
     or any($org_vips,
            strings.icontains(body.plain.raw, .display_name)
-           or strings.icontains(body.plain.raw,
-                                strings.concat(.first_name, " ", .last_name)
-           )
            or strings.icontains(body.plain.raw,
                                 strings.concat(.last_name, ", ", .first_name)
            )
+           or any(regex.extract(.display_name,
+                                '\A(?P<name>.+?)\s*[\(（][^)）]*[)）]\s*\z'
+                  ),
+                  strings.icontains(body.plain.raw, .named_groups["name"])
+           )
     )
   )
   and (
@@ -87,4 +91,4 @@ detection_methods:
 id: "f1011d09-b7dc-5a80-a0eb-ae5f9e5f1ae1"
 og_id: "35a56b8e-9293-5ccf-95d3-c990152d8f48"
 testing_pr: 4515
-testing_sha: 1658ad9fc984cdf4e2a8a85f6af83206ffd6dde1
+testing_sha: 3c7644f9963fb214445fd5add76ce8f949a4acf0