[Test Rules] [PR #4513] modified rule: VIP impersonation with BEC language (near match, untrusted sender)

Author: github-actions[bot]

detection-rules/4513_impersonation_vip_bec_loose.yml

@@ -8,19 +8,30 @@ severity: "medium"
 source: |
   type.inbound
   and any($org_vips,
-          0 <= strings.ilevenshtein(sender.display_name, .display_name) < 4
-          or 0 <= strings.ilevenshtein(sender.display_name,
-                                       strings.concat(.first_name,
-                                                      " ",
-                                                      .last_name
-                                       )
-          ) < 4
-          or 0 <= strings.ilevenshtein(sender.display_name,
-                                       strings.concat(.last_name,
-                                                      ", ",
-                                                      .first_name
-                                       )
-          ) < 4
+          (
+            .display_name != ""
+            and 0 <= strings.ilevenshtein(sender.display_name, .display_name) < 4
+          )
+          or (
+            .first_name != ""
+            and .last_name != ""
+            and 0 <= strings.ilevenshtein(sender.display_name,
+                                          strings.concat(.first_name,
+                                                         " ",
+                                                         .last_name
+                                          )
+            ) < 4
+          )
+          or (
+            .first_name != ""
+            and .last_name != ""
+            and 0 <= strings.ilevenshtein(sender.display_name,
+                                          strings.concat(.last_name,
+                                                         ", ",
+                                                         .first_name
+                                          )
+            ) < 4
+          )
   )
   and any(ml.nlu_classifier(body.current_thread.text).intents,
           .name == "bec" and .confidence in ("medium", "high")
@@ -65,4 +76,4 @@ detection_methods:
 id: "af52ee6e-31f3-52e7-ba94-1e460c89628f"
 og_id: "303081da-6850-5ba6-9589-c3dc7673320e"
 testing_pr: 4513
-testing_sha: 4e4a7760ad81eb7d66ae5f3e4701e7923ebb1f45
+testing_sha: 14caf0d1fb8deb9470797e8b93fc8c0756120fa3