[Shared Samples] [PR #4513] modified rule: PR# 4513 - VIP impersonation with w2 request with reply-to mismatch

Author: github-actions[bot]

detection-rules/4513_impersonation_vip_w2_request.yml

@@ -6,12 +6,23 @@ source: |
   type.inbound
   and (
     any($org_vips,
-        strings.contains(sender.display_name, .display_name)
-        or strings.contains(sender.display_name,
-                            strings.concat(.first_name, " ", .last_name)
+        (
+          .display_name != ""
+          and strings.contains(sender.display_name, .display_name)
         )
-        or strings.contains(sender.display_name,
-                            strings.concat(.last_name, ", ", .first_name)
+        or (
+          .first_name != ""
+          and .last_name != ""
+          and strings.contains(sender.display_name,
+                               strings.concat(.first_name, " ", .last_name)
+          )
+        )
+        or (
+          .first_name != ""
+          and .last_name != ""
+          and strings.contains(sender.display_name,
+                               strings.concat(.last_name, ", ", .first_name)
+          )
         )
     )
     or any(regex.extract(sender.display_name, '^(?<first>\S+)\s+(?<second>\S+)$'),