[Shared Samples] [PR #4639] modified rule: PR# 4639 - Cyrillic vowel substitutions with suspicious subject from unknown sender

Author: github-actions[bot]

detection-rules/4639_link_suspicious_subject_with_cyrillic_substitutions.yml

@@ -6,22 +6,12 @@ source: |
   type.inbound
   and 0 < length(body.links) < 10
   
-  //  display name or subject contains Cyrillic/Greek confusables alongside Latin
-  //  Use OR logic to catch both pure homoglyphs (adjacent) and separated mixed scripts
-  and (
-    // Pure homoglyphs: Latin character immediately adjacent to Cyrillic/Greek
-    any([subject.subject, sender.display_name],
-        regex.contains(.,
-                       '[a-zA-Z][\x{430}\x{435}\x{438}\x{43e}\x{443}\x{440}\x{441}\x{445}\x{456}\x{410}\x{412}\x{415}\x{41a}\x{41c}\x{41d}\x{41e}\x{420}\x{421}\x{422}\x{425}\x{391}\x{392}\x{395}\x{396}\x{397}\x{399}\x{39a}\x{39c}\x{39d}\x{39f}\x{3a1}\x{3a4}\x{3a5}\x{3a7}\x{3bf}]|[\x{430}\x{435}\x{438}\x{43e}\x{443}\x{440}\x{441}\x{445}\x{456}\x{410}\x{412}\x{415}\x{41a}\x{41c}\x{41d}\x{41e}\x{420}\x{421}\x{422}\x{425}\x{391}\x{392}\x{395}\x{396}\x{397}\x{399}\x{39a}\x{39c}\x{39d}\x{39f}\x{3a1}\x{3a4}\x{3a5}\x{3a7}\x{3bf}][a-zA-Z]'
-        )
-    )
-    // OR mixed scripts anywhere: contains both Latin and Cyrillic/Greek (separated)
-    or any([subject.subject, sender.display_name],
-           regex.contains(.,
-                          '[\x{430}\x{435}\x{438}\x{43e}\x{443}\x{440}\x{441}\x{445}\x{456}\x{410}\x{412}\x{415}\x{41a}\x{41c}\x{41d}\x{41e}\x{420}\x{421}\x{422}\x{425}\x{391}\x{392}\x{395}\x{396}\x{397}\x{399}\x{39a}\x{39c}\x{39d}\x{39f}\x{3a1}\x{3a4}\x{3a5}\x{3a7}\x{3bf}]+'
-           )
-           and regex.contains(., '[a-zA-Z]')
-    )
+  // display name or subject contains Cyrillic/Greek confusables within the same word as Latin
+  // Both scripts must appear in a single whitespace-delimited token (true homoglyph substitution)
+  and any([subject.subject, sender.display_name],
+          regex.contains(.,
+                         '[a-zA-Z][^\s]*[\x{430}\x{435}\x{438}\x{43e}\x{443}\x{440}\x{441}\x{445}\x{456}\x{410}\x{412}\x{415}\x{41a}\x{41c}\x{41d}\x{41e}\x{420}\x{421}\x{422}\x{425}\x{391}\x{392}\x{395}\x{396}\x{397}\x{399}\x{39a}\x{39c}\x{39d}\x{39f}\x{3a1}\x{3a4}\x{3a5}\x{3a7}\x{3bf}]|[\x{430}\x{435}\x{438}\x{43e}\x{443}\x{440}\x{441}\x{445}\x{456}\x{410}\x{412}\x{415}\x{41a}\x{41c}\x{41d}\x{41e}\x{420}\x{421}\x{422}\x{425}\x{391}\x{392}\x{395}\x{396}\x{397}\x{399}\x{39a}\x{39c}\x{39d}\x{39f}\x{3a1}\x{3a4}\x{3a5}\x{3a7}\x{3bf}][^\s]*[a-zA-Z]'
+          )
   )
   
   // and suspicious subject
@@ -232,12 +222,6 @@ source: |
     )
   )
   and not profile.by_sender().any_messages_benign
-
-mimic:
-  exempt_canonicals:
-    - 402455  # Historical test sample - 8 other rules still flag
-    - 936366  # Historical test sample - potential legitimate FP
-
 attack_types:
   - "Credential Phishing"
 tactics_and_techniques: