[Shared Samples] [PR #4515] modified rule: PR# 4515 - Fake thread with suspicious indicators

Author: github-actions[bot]

detection-rules/4515_fake_thread_suspicious_indicators.yml

@@ -120,21 +120,39 @@ source: |
     // body contains name of VIP
     (
       any($org_vips,
-          strings.icontains(body.html.inner_text, .display_name)
-          or strings.icontains(body.html.inner_text,
-                               strings.concat(.first_name, " ", .last_name)
+          .display_name != ""
+          and strings.icontains(body.html.inner_text, .display_name)
+          or (
+            .first_name != ""
+            and .last_name != ""
+            and strings.icontains(body.html.inner_text,
+                                  strings.concat(.first_name, " ", .last_name)
+            )
           )
-          or strings.icontains(body.html.inner_text,
-                               strings.concat(.last_name, ", ", .first_name)
+          or (
+            .first_name != ""
+            and .last_name != ""
+            and strings.icontains(body.html.inner_text,
+                                  strings.concat(.last_name, ", ", .first_name)
+            )
           )
       )
       or any($org_vips,
-             strings.icontains(body.plain.raw, .display_name)
-             or strings.icontains(body.plain.raw,
-                                  strings.concat(.first_name, " ", .last_name)
+             .display_name != ""
+             and strings.icontains(body.plain.raw, .display_name)
+             or (
+               .first_name != ""
+               and .last_name != ""
+               and strings.icontains(body.plain.raw,
+                                     strings.concat(.first_name, " ", .last_name)
+               )
              )
-             or strings.icontains(body.plain.raw,
-                                  strings.concat(.last_name, ", ", .first_name)
+             or (
+               .first_name != ""
+               and .last_name != ""
+               and strings.icontains(body.plain.raw,
+                                     strings.concat(.last_name, ", ", .first_name)
+               )
              )
       )
     ),