[Shared Samples] [PR #4507] modified rule: PR# 4507 - Link: Self-sender credential theft with suspicious TLD

Author: github-actions[bot]

detection-rules/4507_link_self_sender_cred_theft_sus_tlds.yml

@@ -9,11 +9,17 @@ source: |
   // auth passes
   and coalesce(headers.auth_summary.dmarc.pass, false)
   // link is suspicious tlds
-  and any(body.links, .href_url.domain.tld in~ $suspicious_tlds)
+  and any(body.links,
+          .href_url.domain.tld in~ $suspicious_tlds
+  //  and sender.email.domain.tld == .href_url.domain.tld
+  )
   // ML signals credential phishing
   and any(ml.nlu_classifier(body.current_thread.text).intents,
           .name == "cred_theft" and .confidence != "low"
   )
+  // exclude json attachments from legit services
+  // all will provide samples without attachments as well
+  and all(attachments, .file_extension != "json")
 attack_types:
   - "Credential Phishing"
 tactics_and_techniques: