[Shared Samples] [PR #4667] modified rule: PR# 4667 - Link: Self-sender with IP geolocation check

github-actions[bot] · github-actions[bot] · commit 9eb5b12f438b · 2026-06-15T18:55:55.000Z
diff --git a/detection-rules/4667_link_self_sender_ip_check.yml b/detection-rules/4667_link_self_sender_ip_check.yml
@@ -10,8 +10,9 @@ source: |
     and recipients.to[0].email.email == sender.email.email
   )
   and any(body.current_thread.links,
-          any(ml.link_analysis(.).unique_urls_accessed,
-              .url == 'https://ipinfo.io/json'
+          .href_url.domain.root_domain != sender.email.domain.root_domain
+          and any(ml.link_analysis(.).unique_urls_accessed,
+                  .url == 'https://ipinfo.io/json'
           )
   )
 attack_types:

Original file line number	Diff line number	Diff line change
`@@ -10,8 +10,9 @@ source: \|`
`10`	`10`	`and recipients.to[0].email.email == sender.email.email`
`11`	`11`	`)`
`12`	`12`	`and any(body.current_thread.links,`
`13`		`- any(ml.link_analysis(.).unique_urls_accessed,`
`14`		`- .url == 'https://ipinfo.io/json'`
	`13`	`+ .href_url.domain.root_domain != sender.email.domain.root_domain`
	`14`	`+ and any(ml.link_analysis(.).unique_urls_accessed,`
	`15`	`+ .url == 'https://ipinfo.io/json'`
`15`	`16`	`)`
`16`	`17`	`)`
`17`	`18`	`attack_types:`